---
title: "Centreon vulnerabilities: CVEs, CISA KEV and security advisories"
url: https://radicalnotion.ai/vendor/centreon
type: vendor
description: "Centreon has 137 published CVEs, 0 in CISA KEV and 34 with public exploits."
updated: 2026-10-29
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Centreon vulnerabilities

- **Published CVEs:** 137
- **In CISA KEV:** 0
- **With a public exploit:** 34
- **With a patch:** 112
- **Average CVSS:** 7.7
- **CVEs in the last two years:** 38
- **First CVE:** 2007-12-20
- **Latest CVE:** 2026-10-29

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 24 |
| High | 68 |
| Medium | 45 |
| Low | 0 |
| Unscored | 0 |

## Most affected products

| Product | CVEs |
| --- | --- |
| [Centreon](https://radicalnotion.ai/vendor/centreon/centreon) | 128 |
| [Centreon web](https://radicalnotion.ai/vendor/centreon/centreon-web) | 57 |
| [centreon/centreon](https://radicalnotion.ai/vendor/centreon/centreon-centreon) | 27 |
| [Infra Monitoring](https://radicalnotion.ai/vendor/centreon/infra-monitoring) | 21 |
| [centreon-archived](https://radicalnotion.ai/vendor/centreon/centreon-archived) | 10 |
| [web](https://radicalnotion.ai/vendor/centreon/web) | 7 |
| [centreon host-monitoring widget](https://radicalnotion.ai/vendor/centreon/centreon-host-monitoring-widget) | 3 |
| [centreon tactical-overview widget](https://radicalnotion.ai/vendor/centreon/centreon-tactical-overview-widget) | 3 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 55 |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 32 |
| [CWE-78](https://radicalnotion.ai/cwe/cwe-78) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 10 |
| [CWE-94](https://radicalnotion.ai/cwe/cwe-94) | Improper Control of Generation of Code ('Code Injection') | 5 |
| [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 4 |
| [CWE-425](https://radicalnotion.ai/cwe/cwe-425) | Direct Request ('Forced Browsing') | 4 |
| [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 2 |
| [CWE-276](https://radicalnotion.ai/cwe/cwe-276) | Incorrect Default Permissions | 2 |

## Assigning CNAs

| CNA | CVEs |
| --- | --- |
| [mitre](https://radicalnotion.ai/cna/mitre) | 81 |
| [Centreon](https://radicalnotion.ai/cna/centreon) | 36 |
| [zdi](https://radicalnotion.ai/cna/zdi) | 18 |
| [certcc](https://radicalnotion.ai/cna/certcc) | 1 |
| [VulDB](https://radicalnotion.ai/cna/vuldb) | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2019 | 19 |
| 2020 | 18 |
| 2021 | 10 |
| 2022 | 7 |
| 2023 | 7 |
| 2024 | 20 |
| 2025 | 24 |
| 2026 | 14 |

## Latest CVEs

| CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-11587 | Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0 | high | 7.2 | 0.3% | No | 2026-10-29 |
| CVE-2025-12523 | Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure | medium | 6.5 | 0.2% | No | 2026-10-29 |
| CVE-2025-13050 | Broken Function Level Authorization — \`postcommand.php\` allows execution of poller post-restart commands by non-admin users | medium | 5.4 | 0.3% | No | 2026-10-29 |
| CVE-2026-14453 | A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets | critical | 9.6 | 0.8% | No | 2026-07-13 |
| CVE-2026-2749 | Path traversal in Centreon Open Tickets | critical | 9.9 | 0.6% | No | 2026-02-27 |
| CVE-2026-2750 | Command Injection via CLAPI generatetraps | critical | 9.8 | 0.3% | No | 2026-02-27 |
| CVE-2026-2751 | Blind SQL Injection | critical | 9.8 | 0.3% | No | 2026-02-27 |
| CVE-2025-15029 | An unauthenticated user is able to introduce SQL Injection using the Awie export module | critical | 9.8 | 13.0% | No | 2026-01-05 |
| CVE-2025-15026 | Unauthenticated configuration import allows administrative account creation using AWIE component | critical | 9.8 | 0.4% | No | 2026-01-05 |
| CVE-2025-12511 | A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page | medium | 6.8 | 0.2% | No | 2026-01-05 |
| CVE-2025-12513 | A user with elevated privileges can inject XSS in the Hosts configuration parameters page | medium | 6.8 | 0.2% | No | 2026-01-05 |
| CVE-2025-12519 | Information disclosure on Administration parameters API endpoint | medium | 5.3 | 0.2% | No | 2026-01-05 |

## Frequently asked questions

### How many CVEs does Centreon have?

Centreon has 137 published CVE records since 2007, including 38 in the last two years.

### How many Centreon CVEs are in CISA KEV?

None of Centreon's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Which Centreon products have the most CVEs?

The Centreon products with the most published CVEs are Centreon, Centreon web, centreon/centreon, Infra Monitoring, centreon-archived.

### What are the most common weakness types in Centreon CVEs?

Centreon's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-94 (Improper Control of Generation of Code ('Code Injection')).

### Are there public exploits for Centreon vulnerabilities?

Yes — 34 of Centreon's CVEs have a known public exploit.

### How many critical Centreon vulnerabilities are there?

Centreon has 24 critical and 68 high-severity CVEs.

### What is the average severity of Centreon CVEs?

The average CVSS base score across Centreon's scored CVEs is 7.7.

## Related vendors

- [Asterisk](https://radicalnotion.ai/vendor/asterisk) (139 CVEs)
- [NLnet Labs](https://radicalnotion.ai/vendor/nlnet-labs) (139 CVEs)
- [envoyproxy](https://radicalnotion.ai/vendor/envoyproxy) (138 CVEs)
- [Snipeitapp](https://radicalnotion.ai/vendor/snipeitapp) (137 CVEs)
- [Crocoblock](https://radicalnotion.ai/vendor/crocoblock) (136 CVEs)
- [Ruijie](https://radicalnotion.ai/vendor/ruijie) (136 CVEs)
- [Tanium](https://radicalnotion.ai/vendor/tanium) (136 CVEs)
- [Themeisle](https://radicalnotion.ai/vendor/themeisle) (136 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/centreon). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.