CVE-2026-49442

mediumpriority · track · 0EPSS 0.002 · 15 %ileDE

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.24% (15th) EPSS

CVSS 5.3 · medium

Is it mine?

2 products

Check your exposure

Who says so?

1 sources

cert_bund

EPSS · scored 2026-10-27

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on whether the provided username exists in the system. When username exists on Cacti, in the response, they see Access Denied! Login failed. When it does not exist on Cacti, they see Access Denied! Login Failed. The only difference between the responses is the capitalization of the letter "f" in the word failed. This issue has been patched in version 1.2.31.

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · security-advisories@github.comexploitability 3.9 · impact 1.4

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-204USprimaryCWE-204US

affected products (2)

Products and version ranges known to be affected.

Open Source Cacti <1.2.31all versionscert_bundDE
Open Source Cacti< 1.2.31cert_bundDE

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2018Cacti: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2026-06-21csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cacti ausnutzen, um Informationen offenzulegen.

sources

Which sources assert this record, and when.

cert_bund NVD CVE.org MITRE

published 2026-10-23modified 2026-10-23

related (248)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2018-7790US	critical9.8OT elevated	2.48% (84th)	—	2018-08-29
An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allow…
CVE-2019-19030US	medium5.3	1.98% (80th)	Exploit	2022-12-26
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether…
CVE-2022-23342US	medium5.3	1.28% (70th)	Exploit	2022-06-21
The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An…
CVE-2015-7902US	medium5.0	3.50% (89th)	Exploit	2015-10-28
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows r…
CVE-2002-0212US	high7.5OT elevated	1.59% (75th)	—	2002-05-16
The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows remote attackers to determine the existen…

+243 more

references (3) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan