CVE-2026-14453CWE-94

A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets

Critical · published July 13, 2026

CVSS v3.1
9.6
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00837 · 57.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-07-13T08:19Z
EPSS history
Timeline
  • 13 JUL 08:19Z
    A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets
    cvelistv5