CVE-2026-14453: A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets
Centreon · Infra Monitoring
Vendor fix available · Affected: Centreon Infra Monitoring · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 58% of scored CVEs
DescriptionCVE.org
This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Centreon · Infra Monitoringfrom 24.10.0 before 24.10.14; from 25.10.0 before 25.10.9
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
CoverageNo articles yet
No CyberSIXT article names CVE-2026-14453 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.