CVE-2026-2750 Command Injection via CLAPI generatetraps
Attackers can execute arbitrary commands on the Centreon Central Server via improper input validation in the Open Tickets module.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2750?
CVE-2026-2750 is a critical command injection vulnerability in Centreon Open Tickets on Central Server, published on 27 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04.
Weakness: CWE-20
Which versions are affected by CVE-2026-2750?
It affects 1 product.
Products include Centreon Web.
How do I fix CVE-2026-2750?
No fix has been published for CVE-2026-2750 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-2750 being exploited?
There is no known exploitation of CVE-2026-2750 in the wild and no public exploit code.
Sources
Also known as GHSA-34c9-25wc-q378.