CVE-2017-12065: Cacti

Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days.

spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.

Affected products

• Cacti Cacti: up to and including 1.1.15

Published 2017-08-01. Last modified 2026-06-17.