Critical severity · published Feb 27, 2026
CVE-2026-2751
Blind SQL Injection
9.8
CVSS
0.3%
EPSS
No
On KEV
Description
Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CW
Centreon Web on Central Server · Centreon
25.10; 24.10;24.04 before 25.10.8, 24.10.20, 24.04.24 · source: vendor
CW
Centreon Web · Centreon
24.04.0 before 24.04.24.; 24.10.0 before 24.10.20; 25.10.0 before 25.10.8 · source: NVD