CVE WatchJul 13, 2026

CVE-2026-14453

This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code

CVSS

9.6

Critical

EPSS

0.5%

p38

KEV

—

Exploit Today

0-100

Published: Jul 13, 2026 · Last modified: Jul 13, 2026 · CWE-94

EPSS · 30d

0.5%EPSS · 30 days0.5%

2026-07-132026-07-17

Technical description

This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.

Official references

github.comhttps://github.com/centreon/centreon/releases

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-32489.8 CRI

100.0%

KEV—80Langflow Missing Authentication Vulnerability4d CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability3d CVE-2026-154107.2 HIG

71.1%

KEV—71SonicWall SMA1000 Appliances Code Injection Vulnerability2d CVE-2025-670389.8 CRI

55.3%

KEV—67Lantronix EDS5000 Code Injection Vulnerability12d CVE-2021-416539.8 CRI

99.5%

——30The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.10d CVE-2023-362558.8 HIG

99.0%

——30An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.10d