Centreon CVE-2026-11587

Requires an authenticated Centreon account that has been granted access to the ACL (access control) management feature - an administrative capability, consistent with PR:H. This is the concrete prerequisite: anonymous users and low-privilege operators without ACL-management rights cannot reach the vulnerable code path. No additional user interaction is needed (UI:N) and it is reachable over the network against the Centreon web interface (AV:N). Fixed in centreon-web 24.10.28 (24.10 branch) and 25.10.15 (25.10 branch); upgrading to these versions is the remediation stated by the available evidence. The specific SQL-injection trigger (parameter/endpoint) is not described in the available sources.

This is a genuine but not emergency-grade issue. The CVSS 3.1 base score of 7.2 (HIGH) is driven by network reachability (AV:N), low attack complexity (AC:L), no user interaction (UI:N), and full CIA impact (C:H/I:H/A:H), but it is held back by PR:H - the attacker must already hold high privileges, specifically a Centreon user with access to ACL management, which is an administrative capability. That precondition is the single most important risk-limiting signal: this is a privilege-to-greater-privilege / data-compromise flaw usable by trusted operators or an attacker who has already compromised an admin-level account, not a path for anonymous internet attackers. No EPSS score was provided in the input, so exploitation probability cannot be quantified. KEV status is not present (no CISA listing), and no public exploit or PoC reference is supplied, so exploitation status is: no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' - meaning it should be remediated on a near-term maintenance cadence rather than as an act_now/emergency fire drill. The signals are internally consistent: a serious SQL injection with full database read/write impact, but gated behind an administrative privilege, reported by the vendor itself with fixed versions available, and with no evidence of active exploitation. Treat it as a patch-this-cycle item.

An authenticated Centreon user who has been granted access to the ACL (access control list) management functionality submits crafted input that is concatenated into a SQL query, allowing them to read and modify arbitrary data in the Centreon back-end database. Because full read and write to the monitoring database is possible, the actor could exfiltrate credentials/configuration or tamper with monitoring data and ACLs. No public exploit code is identified at time of analysis, and the specific injectable parameter or endpoint is not described in the available sources.