What is the CVSS score of CVE-2026-14453?

CVE-2026-14453 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Centreon are affected by CVE-2026-14453?

Centreon's centreon-open-tickets module contains a critical remote code execution vulnerability accessible to any authenticated administrator or operator.. A patch is available.

How to fix or mitigate CVE-2026-14453?

Within 24 hours: Identify all Centreon deployments with the centreon-open-tickets module installed; immediately restrict administrative access to essential personnel only and review recent access logs for suspicious activity. Within 7 days: Implement network-layer access controls to limit Centreon connectivity to trusted monitoring stations; enable detailed logging on message_confirm field processing; and determine whether the open-tickets module is operationally required-disable if not essential. Within 30 days: Monitor Centreon security advisories for patch availability; establish an upgrade procedure to deploy patches within 48 hours of release; and conduct a security audit of credential usage and system access over the past 90 days.

Centreon CVE-2026-14453

EUVD-2026-43316 CRITICAL

Code Injection (CWE-94)

2026-07-13 Centreon

GHSA-623j-mjcm-f442

RCE Code Injection Centreon Infra Monitoring

9.6

CVSS 3.1 · Vendor: Centreon

Severity by source

Vendor (Centreon) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable module needs only a low-privilege authenticated account (PR:L, AC:L); RCE escapes the app to the host (S:C) and permits secret disclosure, data modification, and disruption, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Centreon).

CVSS VectorVendor: Centreon

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 13, 2026 - 10:01 EUVD

Analysis Generated

Jul 13, 2026 - 09:02 vuln.today

CVE Published

Jul 13, 2026 - 08:19 cve.org

CRITICAL 9.6

DescriptionCVE.org

This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.

AnalysisAI

Server-Side Template Injection in Centreon's centreon-open-tickets module enables authenticated users to achieve remote code execution on the Centreon Infra Monitoring server. The message_confirm field is persisted without sanitization and later rendered by the Smarty template engine with no security policy applied, so injected template directives execute as server-side code. Rated CVSS 9.6 with a scope change; no public exploit identified at time of analysis and no EPSS score supplied, but the low authentication barrier and RCE outcome make this a high-priority patch.

Technical ContextAI

The affected component is centreon-open-tickets, a Centreon module that integrates monitoring with external ticketing systems and lets operators define confirmation messages. Those messages (the message_confirm field) are handled by Smarty, a widely used PHP templating engine. Smarty can be sandboxed via a Security Policy object that restricts which PHP functions and tags templates may invoke; here it is instantiated with no security policy, so template syntax such as {php} blocks or function modifiers is evaluated with full engine privileges. This is a classic CWE-94 (Improper Control of Generation of Code / Code Injection) manifesting as SSTI: attacker-controlled data crosses from a stored value into a template that is compiled and executed, turning content into code. Per the CPE cpe:2.3:a:centreon:infra_monitoring:*:*:*:*:*:*:*:* the flaw is in the Centreon Infra Monitoring application layer rather than a specific OS or protocol.

RemediationAI

Upgrade Centreon and the centreon-open-tickets module to the latest fixed release published at https://github.com/centreon/centreon/releases; the provided intelligence points to a GitHub releases page rather than a single tagged fix version, so the released patched version is not independently confirmed here and the exact target build should be verified against Centreon's advisory before deployment. As interim compensating controls until patching, restrict access to the open-tickets ticketing configuration by removing the associated ACL/menu rights from all non-administrative users so fewer accounts can reach the message_confirm field (trade-off: operators lose self-service ticket configuration), tightly limit who holds authenticated Centreon accounts and rotate any credentials that may be shared, and place the Centreon web interface behind network segmentation or a VPN so the AV:N reach is reduced (trade-off: may complicate legitimate remote administration). Because exploitation stems from Smarty rendering without a security policy, do not rely on input filtering as a durable fix - apply the vendor patch.