Centreon CVE-2026-14453

Exploitation requires an authenticated Centreon account (CVSS PR:L) with access to the centreon-open-tickets module's ticket/confirmation configuration, and the ability to save data into the message_confirm field, which is stored unsanitized and later rendered by Smarty with no security policy enabled - that missing security policy is the exact enabling condition. No user interaction is needed (UI:N) and the module is reachable over the network (AV:N). The main limiting factor is that the attacker must already possess valid credentials and permission to reach the open-tickets configuration, so environments that restrict this module to trusted administrators or place the UI behind network controls materially reduce exposure; anonymous, fully external exploitation is not indicated by the vector.

The signals point to a genuine high priority rather than a paper-tiger high-CVSS issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H, 9.6) describes a network-reachable, low-complexity attack needing only a low-privileged authenticated account and no user interaction, with a scope change reflecting escape from the application into the host. The primary mitigating factor is PR:L - an attacker must first hold valid Centreon credentials, which limits fully external anonymous exploitation and points toward insider or post-credential-theft abuse. No EPSS probability was provided, so likelihood cannot be quantified from these inputs; this is a data gap, not evidence of low risk. There is no CISA KEV listing and no POC referenced, so exploitation status is 'no public exploit identified at time of analysis' - but SSTI-to-RCE in Smarty is well-documented and readily weaponizable, so the absence of a published exploit should not be read as safety. One inconsistency worth flagging: the vendor set I:N (no integrity impact) even though arbitrary code execution normally permits data modification; verify with the vendor, as this may understate integrity risk.

An attacker who has obtained or been granted a low-privilege Centreon account navigates to the open-tickets module and saves a confirmation message containing Smarty template syntax (for example a {php} block or code-executing modifier) in the message_confirm field. When that message is subsequently rendered, Smarty compiles and executes the payload on the Centreon server, letting the attacker read environment secrets and run OS commands. No published POC is referenced, but the low attack complexity and well-known Smarty SSTI techniques make this straightforward to develop.