CVE-2026-2751

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2751", "assignerOrgId": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "state": "PUBLISHED", "assignerShortName": "Centreon", "dateReserved": "2026-02-19T14:25:19.973Z", "datePublished": "2026-02-27T13:33:44.787Z", "dateUpdated": "2026-02-27T14:26:21.910Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://download.centreon.com", "defaultStatus": "unaffected", "modules": ["Service Dependencies"], "platforms": ["Linux"], "product": "Centreon Web on Central Server", "vendor": "Centreon", "versions": [{"lessThan": "25.10.8, 24.10.20, 24.04.24", "status": "affected", "version": "25.10; 24.10;24.04", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Texugo from Haka\u00ef Security"}], "datePublic": "2026-02-27T13:31:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.<p>This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24.</p>"}], "value": "Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24."}], "impacts": [{"capecId": "CAPEC-7", "descriptions": [{"lang": "en", "value": "CAPEC-7 Blind SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Blind SQL Injection via unsanitized array keys in Service Dependencies deletion.", "lang": "en"}]}], "providerMetadata": {"orgId": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "shortName": "Centreon", "dateUpdated": "2026-02-27T13:43:22.569Z"}, "references": [{"url": "https://https://thewatch.centreon.com/latest-security-bulletins-64/cve-2026-2751-centreon-web-high-severity-5504"}], "source": {"discovery": "EXTERNAL"}, "title": "Blind SQL Injection", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T14:25:27.597975Z", "id": "CVE-2026-2751", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T14:26:21.910Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2751", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-27T14:25:27.597975Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T14:26:14.215Z"}}], "cna": {"title": "Blind SQL Injection", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Texugo from Haka\u00ef Security"}], "impacts": [{"capecId": "CAPEC-7", "descriptions": [{"lang": "en", "value": "CAPEC-7 Blind SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Centreon", "modules": ["Service Dependencies"], "product": "Centreon Web on Central Server", "versions": [{"status": "affected", "version": "25.10; 24.10;24.04", "lessThan": "25.10.8, 24.10.20, 24.04.24", "versionType": "custom"}], "platforms": ["Linux"], "collectionURL": "https://download.centreon.com", "defaultStatus": "unaffected"}], "datePublic": "2026-02-27T13:31:00.000Z", "references": [{"url": "https://https://thewatch.centreon.com/latest-security-bulletins-64/cve-2026-2751-centreon-web-high-severity-5504"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24.", "supportingMedia": [{"type": "text/html", "value": "Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.<p>This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Blind SQL Injection via unsanitized array keys in Service Dependencies deletion."}]}], "providerMetadata": {"orgId": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "shortName": "Centreon", "dateUpdated": "2026-02-27T13:43:22.569Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2751", "state": "PUBLISHED", "dateUpdated": "2026-02-27T14:26:21.910Z", "dateReserved": "2026-02-19T14:25:19.973Z", "assignerOrgId": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "datePublished": "2026-02-27T13:33:44.787Z", "assignerShortName": "Centreon"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://download.centreon.com", "defaultStatus": "unaffected", "modules": ["Service Dependencies"], "platforms": ["Linux"], "product": "Centreon Web on Central Server", "vendor": "Centreon", "versions": [{"lessThan": "25.10.8, 24.10.20, 24.04.24", "status": "affected", "version": "25.10; 24.10;24.04", "versionType": "custom"}]}], "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*", "matchCriteriaId": "59310DAC-2A79-48BE-8800-02F4E1292B9E", "versionEndExcluding": "24.04.24.", "versionStartIncluding": "24.04.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*", "matchCriteriaId": "BBEDC030-8FF3-49AA-962F-6A997A58319C", "versionEndExcluding": "24.10.20", "versionStartIncluding": "24.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*", "matchCriteriaId": "59EA86A8-6FF7-466E-A58D-7E51BBE187F1", "versionEndExcluding": "25.10.8", "versionStartIncluding": "25.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24."}, {"lang": "es", "value": "Inyecci\u00f3n SQL ciega a trav\u00e9s de claves de array no saneadas en la eliminaci\u00f3n de dependencias de servicio. Vulnerabilidad en Centreon Centreon Web en el servidor central en Linux (m\u00f3dulos de dependencias de servicio) permite inyecci\u00f3n SQL ciega. Este problema afecta a Centreon Web en el servidor central antes de 25.10.8, 24.10.20, 24.04.24."}], "id": "CVE-2026-2751", "lastModified": "2026-06-17T10:31:39.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2751", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T14:25:27.597975Z", "version": "2.0.3"}}]}, "published": "2026-02-27T14:16:30.780", "references": [{"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "tags": ["Broken Link"], "url": "https://https://thewatch.centreon.com/latest-security-bulletins-64/cve-2026-2751-centreon-web-high-severity-5504"}], "sourceIdentifier": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[25.10,25.10.8)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[24.10,24.10.20)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[24.04,24.04.24)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Centreon Web on Central Server", "source": "cna", "vendor": "Centreon"}, "product": "centreon_web_on_central_server", "vendor": "centreon"}], "analysis": {"en": {"generated_at": "2026-04-18T10:15:47.086977+00:00", "value": {"mitigation_remediation": ["Upgrade Centreon Web to 25.10.8 or later, 24.10.20 or later, or 24.04.24 or later to apply the vendor fix.", "If upgrading is not immediately possible, restrict the deletion of service dependencies to users with the highest privilege level and implement server-side validation to ensure array keys are numeric or strictly typed.", "Configure a web application firewall to block or alert on suspicious SQL payloads targeting the deletion endpoint.", "Continuously monitor application and database logs for abnormal query patterns that could indicate an attempted injection."], "summary": {"action": "Immediate Patch", "impact": "Database Data Compromise via Blind SQL Injection"}, "threat_synthesis": {"affected_systems": "Centreon Web on the Central Server, specifically the Service Dependencies module on Linux, is affected. Versions prior to 25.10.8, 24.10.20, and 24.04.24 are listed as vulnerable in the vendor advisory.", "description_and_impact": "The vulnerability arises from unsanitized array keys used when deleting service dependencies in the Centreon Web on the Central Server. This flaw allows a blind SQL injection that can be triggered when processing deletion requests. Based on the description, it is inferred that an attacker could manipulate the underlying database queries, potentially retrieving or altering data stored in the database.", "risk_and_exploitability": "The flaw carries a CVSS score of 8.3, indicating high severity. The EPSS score is reported as less than 1%, suggesting a low probability of active exploitation at the time of assessment, and it is not listed in the CISA KEV catalog. The likely attack path involves interacting with the deletion endpoint exposed in the web interface, which requires the ability to send requests to that endpoint. Based on the description, it is inferred that the attacker could exploit the vulnerability by sending crafted deletion requests that include malicious array keys."}}}}, "created": "2026-03-02T12:07:14.438398+00:00", "updated": "2026-04-18T10:30:35.748820+00:00", "vendors": ["centreon", "centreon$PRODUCT$centreon_web_on_central_server"]}