Patchfirst: Cacti vulnerabilitieshttps://patchfirst.co/vendor/cacti/New and newly exploited Cacti CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2025-24367: Cacti allows Arbitrary File Creation leading to RCEhttps://patchfirst.co/cve/CVE-2025-24367/CVE-2025-24367Mon, 27 Jan 2025 00:00:00 GMTCacti · cacti. Not in CISA KEV. EPSS 54.3% (higher than 99.01% of CVEs). CVSS 8.7 HIGH. Public exploit code exists. Priority 30.9 of 100.public-exploitCVE-2024-29895: Cacti command injection in cmd_realtime.phphttps://patchfirst.co/cve/CVE-2024-29895/CVE-2024-29895Mon, 13 May 2024 00:00:00 GMTCacti · cacti. Not in CISA KEV. EPSS 98.8% (higher than 99.93% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 67.0 of 100.public-exploitCVE-2024-25641: Cacti RCE vulnerability when importing packageshttps://patchfirst.co/cve/CVE-2024-25641/CVE-2024-25641Mon, 13 May 2024 00:00:00 GMTCacti · cacti. Not in CISA KEV. EPSS 86.3% (higher than 99.73% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. Priority 32.0 of 100.public-exploitCVE-2023-49085: Cacti SQL Injection vulnerabilityhttps://patchfirst.co/cve/CVE-2023-49085/CVE-2023-49085Fri, 22 Dec 2023 00:00:00 GMTCacti · cacti. Not in CISA KEV. EPSS 74.5% (higher than 99.49% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 31.7 of 100.public-exploitCVE-2023-51448: SQL Injection vulnerability when managing SNMP Notification Receivershttps://patchfirst.co/cve/CVE-2023-51448/CVE-2023-51448Fri, 22 Dec 2023 00:00:00 GMTCacti · cacti. Not in CISA KEV. EPSS 67.3% (higher than 99.3% of CVEs). CVSS 8.8 HIGH. Priority 26.0 of 100.CVE-2023-49084: Local File Inclusion (RCE) in Cactihttps://patchfirst.co/cve/CVE-2023-49084/CVE-2023-49084Thu, 21 Dec 2023 00:00:00 GMTCacti · cacti. Not in CISA KEV. EPSS 64.4% (higher than 99.23% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. Priority 31.2 of 100.public-exploitCVE-2023-39361: Unauthenticated SQL Injection in graph_view.php in Cactihttps://patchfirst.co/cve/CVE-2023-39361/CVE-2023-39361Tue, 05 Sep 2023 00:00:00 GMTCacti · cacti. Not in CISA KEV. EPSS 88.8% (higher than 99.78% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 72.5 of 100.public-exploitCVE-2023-39362: Authenticated command injection in SNMP options of a Devicehttps://patchfirst.co/cve/CVE-2023-39362/CVE-2023-39362Tue, 05 Sep 2023 00:00:00 GMTCacti · cacti. Not in CISA KEV. EPSS 85.4% (higher than 99.72% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. Priority 30.0 of 100.public-exploit[KEV] CVE-2022-46169: Cacti Command Injection Vulnerabilityhttps://patchfirst.co/cve/CVE-2022-46169/CVE-2022-46169#kevThu, 16 Feb 2023 00:00:00 GMTCacti · Cacti. In CISA KEV since 2023-02-16. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.kevpublic-exploitT1190T1059