Infra Monitoring vulnerabilities

6 known vulnerabilities in Infra Monitoring from Centreon. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.6 Critical severity

  Infra Monitoring: Improper Control of Generation of Code

  CVE-2026-14453Jul 13, 2026Centreon

  This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enab

• 9.8 Critical severity

  Infra Monitoring: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-15029Jan 5, 2026CentreonEPSS 13%

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2

• 9.8 Critical severity

  Infra Monitoring: Missing Authentication for Critical Functionality

  CVE-2025-15026Jan 5, 2026Centreon

  Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 2

• 7.2 High severity

  Infra Monitoring: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-5965Jan 5, 2026CentreonEPSS 28%

  In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Backup c

• 8.4 High severity

  Infra Monitoring: Incorrect Default Permissions

  CVE-2025-8432Oct 27, 2025Centreon

  Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on the MBI server This issue affects Infra Monitoring: from 24.10.0 before 24.10.6, from 24.04.0 before 24

• 7.2 High severity

  Infra Monitoring: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-5946Oct 14, 2025CentreonEPSS 13.5%

  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection. On the poller parameters page, a user with hig