This vulnerability (CVE-2026-14453) is a critical SSTI in Centreon Infra Monitoring's centreon-open-tickets module. The issue stems from the unsafe handling of the message_confirm field, which is stored without proper sanitization and rendered via Smarty templates lacking security policies. This allows any authenticated user to inject malicious code that executes on the server, potentially disclosing environment secrets and causing denial of service. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). It affects specifically versions 24.10.0 and 25.10.0 of the product. No official patch or remediation has been indicated yet.

Successful exploitation allows an authenticated user to execute arbitrary code on the server hosting Centreon Infra Monitoring, leading to potential disclosure of sensitive environment secrets and disruption of platform availability. The CVSS v3.1 score is 9.6 (critical), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to trusted personnel only and monitor for suspicious activity related to the centreon-open-tickets module. Avoid exposing the affected versions (24.10.0 and 25.10.0) in untrusted environments.