# CVE-2026-14453: Centreon centreon-open-tickets SSTI in message_confirm field

Source: https://junglewise.ai/threats/cve-2026-14453-centreon-centreon-open-tickets-ssti-in-message-confirm-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-14453 · Severity: critical · CVSS 9.6 · Published 2026-07-13

A critical security vulnerability exists in Centreon's ticketing module, which is used for managing IT infrastructure alerts. An attacker with basic user access can execute malicious commands on the server, potentially leading to the theft of sensitive credentials or a complete shutdown of the monitoring platform. This could disrupt an organization's ability to track and respond to IT system failures.

Technologies: [Centreon Open Tickets](https://junglewise.ai/threats/technologies/open-tickets). Vendors: [Centreon](https://junglewise.ai/threats/vendors/centreon).

## Quick answers

**Is CVE-2026-14453 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14453 being exploited in the wild.

**How severe is CVE-2026-14453?** Critical severity, with a CVSS score of 9.6, published 13 July 2026.

**Which products and versions are affected?** Centreon Open Tickets 24.10.0 to 24.10.13, 25.10.0 to 25.10.8.

**Is there a fix for CVE-2026-14453?** A patch was published on 2026-07-08: Patched versions 24.10.14 and 25.10.9 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14453 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-14453?** Check whether you run Centreon Open Tickets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Template Injection (SSTI) vulnerability exists in the 'message_confirm' field of the Centreon centreon-open-tickets module. The root cause is the lack of sanitization for user-supplied input which is subsequently rendered by the Smarty template engine without an active security policy. An authenticated attacker with low privileges can exploit this via the network to achieve Remote Code Execution (RCE). This can lead to the disclosure of environment secrets and impact the availability of the monitoring product. Patches are available in versions 24.10.14, 25.10.9, and 26.05.1.

## Affected products

- Centreon Infra Monitoring (centreon-open-tickets) 24.10.0 to 24.10.13, 25.10.0 to 25.10.8

## Timeline

- 2026-07-08: patched: Patched versions 24.10.14 and 25.10.9 released.
- 2026-07-13: disclosed: CVE-2026-14453 published.

## References

- [https://github.com/centreon/centreon/releases](https://github.com/centreon/centreon/releases)

## Related threats

- [Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon…](https://junglewise.ai/threats/cve-2025-8460-improper-neutralization-of-input-during-web-page-generation-xss-or)
- [Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra…](https://junglewise.ai/threats/cve-2025-12514-improper-neutralization-of-special-elements-used-in-an-sql)