CVE-2026-14453: falha crítica em Centreon Infra Monitoring
A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.6epss 0.8%
This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
Produtos afetados
Centreon · Infra MonitoringCVEs relacionadas — Centreon Infra Monitoring
No mesmo produto, das mais perigosas para as menos.
CVE-2025-5965HIGHRCE via the backup feature available only to user with high privilegeEPSS 28.2%CVE-2025-5946HIGHRCE via the poller reload feature available only to user with high privilegeEPSS 13.5%CVE-2025-15029CRITICALAn unauthenticated user is able to introduce SQL Injection using the Awie export moduleEPSS 13.0%CVE-2025-8432HIGHCentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRONEPSS 0.4%CVE-2025-15026CRITICALUnauthenticated configuration import allows administrative account creation using AWIE componentEPSS 0.4%CVE-2025-54891MEDIUMA user with elevated privileges can inject XSS in the ACL Resource Access configuration pageEPSS 0.3%