What is CVE-2026-14453?

CVE-2026-14453 is a critical-severity vulnerability in Centreon Infra Monitoring, classified under Code Injection. CVSS score: 9.6/10. Published 2026-07-13.

How severe is CVE-2026-14453?

Critical severity. CVSS v3 base score is 9.6 out of 10.

RCE in Centreon Infra Monitoring

CVE-2026-14453

This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.008 (55.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H.

Affected products

Centreon Infra Monitoring — versions 24.10.0, 25.10.0

Weakness classification (CWE)

CWE-94 — Code Injection

References

bd4443e6-1eef-43f3-9886-25fc9ceeaae7 (release-notes)

Frequently asked questions

What is CVE-2026-14453?: CVE-2026-14453 is a critical-severity vulnerability in Centreon Infra Monitoring, classified under Code Injection. CVSS score: 9.6/10. Published 2026-07-13.
How severe is CVE-2026-14453?: Critical severity. CVSS v3 base score is 9.6 out of 10.