Multiple vulnerabilities in Centreon Web allow remote code
Multiple vulnerabilities in Centreon Web allow remote code execution and security policy bypass, affecting versions prior to 25.10.12 and 24.10.25.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The French CERT (CERT-FR) has issued an advisory regarding multiple security vulnerabilities discovered in Centreon Web, an infrastructure monitoring platform. The vulnerabilities enable two distinct attack vectors: remote arbitrary code execution and security policy bypass. These flaws affect Centreon Web versions in the 25.10.x branch prior to 25.10.12, as well as all versions in the 24.10.x branch prior to 24.10.25.
Centreon has addressed these vulnerabilities in their May 2026 monthly security bulletin, publishing patches for affected versions. Organizations running vulnerable versions of Centreon Web should prioritize applying the security updates to mitigate the risk of unauthorized remote code execution and potential compromise of their monitoring infrastructure.
Given that Centreon is commonly deployed in enterprise environments for infrastructure monitoring, successful exploitation could provide attackers with access to sensitive operational data and potentially enable lateral movement within monitored networks. The combination of remote code execution capability with security policy bypass represents a significant threat to affected installations.
Detection guidance
Suspicious Child Process Spawned by Web Server Process (Possible Centreon RCE Exploitation)
A behavioural hunt for the technique in general.
Detects a web server or PHP-FPM process spawning a shell or command interpreter, consistent with exploitation of a PHP web application RCE vulnerability such as those in Centreon Web. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Web Server Process
id: 813f288e-1921-568f-a4e9-5d1d53fbad44
status: experimental
description: 'Detects command interpreters or shells spawned as children of web server
or PHP-FPM processes.
This pattern is consistent with exploitation of remote code execution vulnerabilities
in
PHP-based web applications such as Centreon Web, where an attacker-controlled request
causes
the web server process to execute an OS command.
'
references:
- CERT-FR advisory on Centreon Web RCE vulnerabilities
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /httpd
- /apache2
- /php-fpm
- /php-fpm7
- /php-fpm8
- /nginx
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ksh
- /zsh
- /perl
- /python
- /python3
- /curl
- /wget
- /nc
- /ncat
filter:
CommandLine|contains:
- logrotate
- healthcheck
- graceful
condition: selection_parent and selection_child and not filter
falsepositives:
- Legitimate PHP scripts that invoke shell utilities for scheduled monitoring tasks
(e.g. Centreon plugins executing shell/nagios plugin scripts)
- Web server health check or log rotation scripts
level: high
Reconnaissance Commands Executed by Web Application Service Account (Post-Exploitation of Web RCE)
A behavioural hunt for the technique in general.
Detects common reconnaissance commands (whoami, id, uname, hostname) executed under a web server service account, indicating potential post-exploitation activity following a web application RCE such as the Centreon Web vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reconnaissance Commands Executed by Web Server Service Account
id: 5e7f6b01-f3b9-5af4-93ee-9d0d84b11a33
status: experimental
description: 'Detects execution of basic system reconnaissance commands (whoami, id,
uname, hostname) run
by a low-privilege web application account (e.g. www-data, apache, nginx, centreon).
This is a
common early-stage post-exploitation behavior following successful exploitation
of a remote
code execution vulnerability in a public-facing web application such as Centreon
Web.
'
references:
- CERT-FR advisory on Centreon Web RCE vulnerabilities
author: Vorant
tags:
- attack.t1190
- attack.discovery
logsource:
category: process_creation
product: linux
detection:
selection_user:
User:
- www-data
- apache
- nginx
- centreon
- centreon-web
selection_cmd:
Image|endswith:
- /whoami
- /id
- /uname
- /hostname
- /uname -a
condition: selection_user and selection_cmd
falsepositives:
- Centreon plugin scripts or monitoring probes that legitimately gather host facts
under the service account
- Configuration management or provisioning tools running under the same service account
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0659
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs