CVE-2026-14453 -- CVSS 9.6 Vulnerability Briefing

CVE-2026-14453 | CVSS 9.6 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-14453 is a critical Server-Side Template Injection (SSTI) vulnerability in the centreon-open-tickets module of Centreon, a widely deployed IT infrastructure monitoring platform, that enables unauthenticated or authenticated remote attackers to achieve Remote Code Execution on the underlying server.

Technical Detail

The flaw originates in the message_confirm field within the centreon-open-tickets module, which accepts user-supplied input and stores it without sanitization or output encoding before it is rendered through a server-side template engine. An attacker who can submit or influence the value of this field can inject template directives that are evaluated at render time, resulting in arbitrary operating system command execution in the context of the web server process. Successful exploitation yields full Remote Code Execution, which could allow an attacker to exfiltrate credentials, pivot to monitored infrastructure, or establish persistent access on the Centreon host.

Exploitation Status

No known exploit code has been publicly observed as of July 20, 2026. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been confirmed. The exploit maturity is currently assessed as no known exploit; however, SSTI vulnerabilities with clear injection points are generally straightforward to weaponize once the template engine and injection context are identified, which lowers the practical barrier for capable actors.

Who Is Targeting This

No confirmed threat actor attribution is available for this vulnerability at this time. The reported actor fields in available data reference no public CVE record or exploitation reporting found in vendor advisories, CERT sources, CISA KEV, or threat intelligence sources, which indicates an absence of attribution rather than confirmed targeting. No specific threat actor has been linked to exploitation of CVE-2026-14453 in any verified reporting as of the date of this briefing.

What To Do

Organizations running Centreon with the centreon-open-tickets module should apply the vendor-supplied patch for this vulnerability as a priority given the critical CVSS score of 9.6 and the RCE impact. If a patch is not yet available or cannot be applied immediately, administrators should restrict access to the Centreon web interface to trusted internal networks or VPN-only access, and disable or remove the centreon-open-tickets module if it is not operationally required. Input validation controls at the web application firewall layer targeting template injection patterns (such as {{, {%, and similar syntax) can provide partial detection and blocking capability. Monitor web server logs for anomalous template syntax appearing in POST body parameters associated with the ticket confirmation workflow. This CVE is not currently subject to a CISA binding directive, but the critical severity warrants treating it as a high-priority remediation item regardless of formal mandates.