What is the CVSS score of CVE-2026-2751?

CVE-2026-2751 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Centreon Web are affected by CVE-2026-2751?

Centreon Web installations are vulnerable to SQL injection attacks through the Service Dependencies module, potentially allowing attackers to extract sensitive data from the database without…

How to fix or mitigate CVE-2026-2751?

Within 24 hours: Identify all Centreon Web instances and their current versions; restrict network access to the Service Dependencies module to authorized administrators only. Within 7 days: Implement WAF rules to block SQL injection patterns targeting the Service Dependencies deletion functionality; enable enhanced logging and monitoring for suspicious database queries. Within 30 days: Upgrade to patched versions (25.10.8, 24.10.20, or 24.04.24) as they become available; conduct a security audit of database logs for evidence of exploitation.

Centreon Web CVE-2026-2751

HIGH

SQL Injection (CWE-89)

2026-02-27 bd4443e6-1eef-43f3-9886-25fc9ceeaae7

Linux SQLi Centreon Web

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 14:16 nvd

HIGH 8.3

DescriptionCVE.org

Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24.

AnalysisAI

Blind SQL injection in Centreon Web's Service Dependencies module allows authenticated attackers to extract sensitive database information through unsanitized array keys in deletion requests. This vulnerability affects Centreon Web versions before 25.10.8, 24.10.20, and 24.04.24 on Linux systems, requiring valid credentials but no user interaction to exploit. No patch is currently available, leaving affected deployments vulnerable to database reconnaissance and potential data exfiltration.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the unsanitized array keys in component of Centreon Web. Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.