Vulnerability · Published Jul 13, 2026 · Assigned by Centreon

CVE-2026-14453A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets

Critical 9.6

In plain English

A critical-severity code injection in Infra Monitoring from Centreon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)0.8%top 42.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.

Affected products (as reported)

Vendor	Product	Versions
Centreon	Infra Monitoring	24.10.0 – before 24.10.1425.10.0 – before 25.10.9

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

References

https://github.com/centreon/centreon/releases release-notes