Cacti Servers Under Attack as Majority Fail to Patch Critical Vulnerability

Cacti, a widely used open-source network monitoring and graphing platform, contains a command injection flaw (CWE-74) that lets a completely unauthenticated attacker execute arbitrary commands on the Cacti server. The bug is reachable through the web-facing remote_agent.php script, where an attacker can spoof a trusted poller address (e.g., via a forwarded-client HTTP header) to bypass authentication and inject shell metacharacters into parameters used to build polling commands. Successful exploitation yields code execution in the context of the web server, giving an attacker a foothold on a monitoring system that typically has broad network visibility and stored credentials for many managed devices. Any Cacti deployment running vulnerable code is affected, with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild — the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-02-16, and EPSS assigns it a 99.8% probability of exploitation.

Do: Apply CISA's required action by upgrading Cacti to the patched release (1.2.23 or later per vendor guidance). Until patched, restrict access to remote_agent.php to known poller source addresses and monitor web access and Cacti logs for signs of exploitation. Prioritize internet-exposed Cacti servers, since KEV listing confirms active exploitation and ransomware use is listed as unknown.

CVE-2023-22952 is a remote code execution vulnerability in multiple SugarCRM products caused by missing input validation (CWE-20) that permits PHP code injection (CWE-94) through the EmailTemplates feature. An attacker with low-privilege (authenticated) access sends a crafted request to EmailTemplates that injects and executes arbitrary custom PHP code on the server. Successful exploitation yields full server-side code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8), and the associated public proof-of-concept demonstrates shell upload, creating risk of follow-on activity such as ransomware. Organizations running affected SugarCRM releases prior to 12.0 Hotfix 91155 are exposed. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2023-02-02, EPSS assigns an 80.1% probability of exploitation within 30 days (100th percentile), and trade press reported active attacks.

Do: Apply the vendor fix immediately per CISA's KEV required action — SugarCRM 12.0 Hotfix 91155 or a later patched release per vendor instructions. Audit EmailTemplates and the server filesystem for injected PHP code or uploaded webshells, and review web logs for crafted requests to EmailTemplates endpoints. Treat unpatched, internet-exposed SugarCRM instances as high priority, as ransomware use is listed as unknown and active exploitation is confirmed.