Cacti (software)

Cacti
Original author	Ian Berry
Developers	The Cacti Group, Inc.
Initial release	September 23, 2001 (2001-09-23)1
Stable release	1.2.302  / 23 March 2025 (23 March 2025)
Written in	PHP3
Operating system	Linux, FreeBSD, macOS, Windows
Type	Network monitoring
License	GNU General Public License
Website	www.cacti.net
Repository	github.com/Cacti/cacti

Cacti is a free and open-source, web-based network monitoring and graphing application. It functions as a front end for RRDtool, collecting time-series data from network devices and presenting the data as graphs through a web interface.⁴⁵

Created by Ian Berry in 2001, Cacti is written in PHP, uses MySQL or MariaDB for configuration storage, and is released under the GNU General Public License.⁶³ It polls devices through Simple Network Management Protocol (SNMP), stores values in RRDtool databases, and can also collect data through scripts and executables.⁷

The software has been covered as a practical open-source monitoring tool by technology publications including InfoWorld, Linux.com, Computer Weekly, Network World and Opensource.com.^5891011

Berry began Cacti while working for a small internet service provider during high school. In a 2007 account, he said the project was intended to offer more ease of use than RRDtool and more flexibility than MRTG.⁶ The first public files for version 0.5 were published on SourceForge on September 23, 2001.¹

Version 0.8.6, released in September 2004, brought additional developers and improvements in speed and scalability.⁶¹² Version 0.8.7 followed in October 2007.¹³

After a period in which the 0.8.8 branch received mainly bug fixes and security patches, The Cacti Group released version 1.0.0 in January 2017.¹⁴ The release added multiple data collectors, user group permissions, multiple polling intervals and site support.¹⁴ The 1.2.x branch began in 2019 and continued as the main stable series in the 2020s.¹⁵

Cacti operates on a polling cycle. At configured intervals, a data collector queries monitored devices, records the resulting values, and passes them to RRDtool for storage and graph generation.⁴ The default PHP poller, cmd.php, is intended for smaller installations; Spine, a multi-threaded C-based poller, is used for larger deployments.¹⁶

The application uses templates to define monitored data, graph presentation and device profiles. Administrators can use templates to apply common graph and data-source definitions across multiple devices.⁷ Cacti also supports role-based access control, external authentication through LDAP or Active Directory, automatic device discovery and remote pollers for distributed monitoring.⁷

Cacti's plugin architecture extends the application beyond graphing. Official and community plugins add functions such as threshold alerting, syslog collection, NetFlow and sFlow reporting, device status dashboards, configuration auditing and network topology maps.³

Cacti is packaged by several operating-system distributions. The Debian package describes it as a PHP-driven front end for RRDtool that stores data-source information, handles data gathering and populates a MySQL database with round-robin archives.¹⁷ The FreeBSD Ports collection includes Cacti under net-mgmt/cacti as a web-driven graphing interface for RRDtool.¹⁸

Cacti has also been used as a component in other monitoring products. IBM Spectrum LSF RTM, an operational dashboard for IBM Spectrum LSF environments, uses Cacti as a graphical user-interface framework for monitoring, reporting and alerting; IBM documents the LSF-specific functions as a Cacti plugin layered on top of the open-source package.¹⁹

In December 2022, SonarSource disclosed CVE-2022-46169, an unauthenticated remote code execution vulnerability in Cacti's remote_agent.php endpoint. The flaw combined an authentication bypass with command injection and received a CVSS score of 9.8 from the National Vulnerability Database.²⁰²¹ The Cacti Group patched the vulnerability in version 1.2.23.²²

In January 2023, BleepingComputer reported active exploitation of the vulnerability, including deployment of Mirai malware and IRC-based botnets against unpatched systems.²³ The Cybersecurity and Infrastructure Security Agency added CVE-2022-46169 to its Known Exploited Vulnerabilities catalog in February 2023.²⁴

Later releases addressed additional vulnerabilities. Version 1.2.27, released in May 2024, patched twelve issues, including arbitrary file write and command-injection vulnerabilities.²⁵ Version 1.2.29, released in February 2025, patched an authenticated remote code execution vulnerability involving multi-line SNMP responses.²⁶

InfoWorld reviewed Cacti in 2006 as a useful first step for organizations adopting network monitoring, noting that it made RRDtool-based graphing easier to configure through a web interface.⁵ Linux.com described it in 2005 as a network-monitoring package for collecting and visualizing SNMP data.⁸ Computer Weekly covered Cacti in 2008 as an open-source option for router monitoring.⁹ In a 2008 roundup of open-source monitoring tools, InfoWorld described Cacti as a leading open-source network graphing tool and emphasized its templates for monitoring SNMP-speaking devices such as servers, routers and switches.²⁷

Later coverage continued to list Cacti among free or open-source network-monitoring tools. Network World included it in a 2022 list of free tools for network engineers, and Opensource.com listed it among open-source network monitoring tools in 2019.¹⁰¹¹