Study finds legacy network monitoring platforms often exposed with security risks

A study using ZoomEye data from September 2026 identified thousands of exposed instances of monitoring platforms Cacti and LibreNMS. These systems accumulate over time, often managed by departed engineers and excluded from asset inventories. They typically store credentials granting broad access to the devices they monitor, creating significant security risks. Cacti specifically has a history of vulnerabilities exploitable by authenticated users. Security recommendations include restricting interfaces to management networks, auditing credentials, and maintaining regular patch cycles.