Read the docs
TI-2026-82677 Aliases CVE-2026-11587GHSA-c9w7-ppf8-758c

Centreon ACL SQL injection lets authenticated users read and modify data

Priority LOW 33CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Centreon contains an SQL injection flaw in ACL management (Resources and Actions) caused by unsafe handling of PHP array keys, classified as CWE-89. An authenticated user with access to ACL management can exploit it to read and modify the Centreon database. The flaw is rated high severity under CVSS 3.1 with a score of 7.2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00264 18th percentileScored 2026-11-07
Fix Fixed Centreon (Centreon): centreon-web-25.10.15, centreon-web-24.10.28

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CentreonCentreon25.10 to before centreon-web-25.10.15; 24.10 to before centreon-web-24.10.28centreon-web-25.10.15, centreon-web-24.10.28Patch availableCNA
  • Centreon VendorCentreon Affected 25.10 to before centreon-web-25.10.15; 24.10 to before centreon-web-24.10.28 Fixed in centreon-web-25.10.15, centreon-web-24.10.28 Patch available CNA

Remediation

Upgrade Centreon to centreon-web-25.10.15 for the 25.10 series or to centreon-web-24.10.28 for the 24.10 series. The affected ranges run from 25.10 before centreon-web-25.10.15 and from 24.10 before centreon-web-24.10.28.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA Centreon (Centreon) Fixed in centreon-web-25.10.15, centreon-web-24.10.28

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-11587
  2. 2026-10-29 Alias added: GHSA-c9w7-ppf8-758c
  3. 2026-10-30 CISA SSVC decision points changed
  4. 2026-10-30 Priority changed: MEDIUM → LOW

References

Advisory 1

Other 1

See all 130 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences