Back to overview

CVE-2026-14453

CRITICAL
9.6
CVSS 3.1
Description
This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.

Metadata

CVE ID
CVE-2026-14453
State
PUBLISHED
Assigner
Centreon
Reserved
2026-07-02 08:14 UTC
Published
2026-07-13 08:19 UTC
Last updated
2026-07-13 13:54 UTC
Primary CWE
CWE-94
CWE-94 The software constructs all or part of a code segment…
Vendor / Product
Centreon / Infra Monitoring
Sources
cve.org  ·  NVD

Severity & Metrics

9.6 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Centreon Infra Monitoring — 24.10.0 < 24.10.14, 25.10.0 < 25.10.9
Weakness (CWE)
CWESourceDescription
CWE-94 cna CWE-94 The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.6 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
References (1)
Back to overview