Skip to content
Critical RCE Vulnerability in Cacti Exploited

Critical RCE Vulnerability in Cacti Exploited

First seen 14 Nov 2026, 23:41 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 14, 2026 at 23:42 UTC
  • •CVE-2022-46169 allows unauthenticated RCE on Cacti installations.
  • •Exploitation requires only knowledge of the server's IP address.
  • •The vulnerability has been actively exploited since early 2023.

CVE-2022-46169 is a critical vulnerability in Cacti versions ≤ 1.2.22, allowing unauthenticated remote code execution. Attackers can exploit this flaw by sending a specially crafted HTTP request to the `remote_agent.php` file, bypassing authentication through a forged `X-Forwarded-For` header. The vulnerability results from improper handling of the `poller_id` parameter, enabling command injection. This flaw affects any Cacti installation accessible over the internet, making it a significant risk for organizations using this platform. The vulnerability was published on December 5, 2022, and has been since its addition to the CISA KEV list on February 16, 2023. A proof-of-concept (PoC) was made public shortly after its disclosure, increasing the risk of exploitation. Organizations are urged to patch their systems to mitigate this threat.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2022-12-05
CVE-2022-46169 published
CVE-2022-46169 disclosed as a critical RCE vulnerability in Cacti.
Sploitus
2022-12-07
First public PoC released
A proof-of-concept for CVE-2022-46169 was made publicly available, facilitating exploitation.
Sploitus
2023-02-16
CISA adds CVE to KEV list
CISA added CVE-2022-46169 to its Known Exploited Vulnerabilities catalog due to active exploitation.
Sploitus

More articles in this cluster (3)

Following this threat?

Track CVE-2022-46169 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 4

Common questions

What versions of Cacti are affected?
Cacti versions 1.2.22 and earlier are vulnerable to CVE-2022-46169.
Is there a patch available?
Yes, users should upgrade to the latest version of Cacti to mitigate this vulnerability.
How can I detect if my system is compromised?
Monitor server logs for unusual command executions or unauthorized access attempts.