Centreon
CVE-2026-2749
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Centreon user
-
ExploitSubmit crafted path traversal payload
-
ExecutionAccess arbitrary files outside Open Tickets directory
-
ImpactExecute code or extract sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Centreon Open Tickets module on Central Server versions before 25.10.3, 24.10.8, or 24.04.7. Authenticated user account with any privilege level required (PR:L). Centreon Open Tickets must be installed and enabled on the Central Server. |
| Impact | CVSS 9.9. Centreon is a widely-used IT monitoring platform — filesystem access compromises monitoring infrastructure and potentially monitored systems' credentials. |
| Exploit ScenarioDerived | Authenticated Centreon user exploits path traversal to read database credentials, SNMP community strings, or SSH keys stored in Centreon's configuration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Path traversal in Centreon Open Tickets module allows authenticated attackers to read or write files outside intended directories. CVSS 9.9 with scope change indicates impact beyond the vulnerable component.
Earlier versions of this analysis (1)
Path traversal in Centreon Open Tickets module.
RemediationAI
Update Centreon Open Tickets module. Review filesystem permissions for Centreon service account.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-22 in Centreon Open Tickets. Authenticated users can traverse the filesystem through the ticketing module, with scope change indicating potential impact on the underlying Centreon server.
Know when Centreon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10.3, 24.10.8, 24.04.7.
Executive ViewAI
A critical vulnerability (CVSS 9.9) in Centreon Open Tickets allows unauthorized access and potential system compromise on affected Central Servers running versions before 25.10.3, 24.10.8, or 24.04.7. Organizations using Centreon for infrastructure monitoring face immediate risk of data breach, service disruption, and loss of operational visibility if this vulnerability is exploited.
- Restrict network access to Centreon Central Server to only authorized administrative systems using firewall rules; 2) Disable the Open Tickets module if not actively used; 3) Implement Web Application Firewall (WAF) rules to block malicious requests to vulnerable endpoints; 4) Monitor logs for suspicious access patterns to the ticket module; 5) Enforce strong authentication (MFA) for all Centreon administrative access; 6) Maintain offline backups of critical monitoring configurations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)CVE.org
displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remot
Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3
Authenticated OS command injection in Centreon Web (Infra Monitoring) lets a high-privilege user execute arbitrary opera
A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unau
Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter
A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authen
A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authen
Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRD
Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (
minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the comman
Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitra
GitHub PoC
Exploit-DB