Multiple vulnerabilities in Centreon Web allow remote code

29 May 2026 critical vulnerability

Multiple vulnerabilities in Centreon Web allow remote code execution and security policy bypass, affecting versions prior to 25.10.12 and 24.10.25.

The French CERT (CERT-FR) has issued an advisory regarding multiple security vulnerabilities discovered in Centreon Web, an infrastructure monitoring platform. The vulnerabilities enable two distinct attack vectors: remote arbitrary code execution and security policy bypass. These flaws affect Centreon Web versions in the 25.10.x branch prior to 25.10.12, as well as all versions in the 24.10.x branch prior to 24.10.25.

Centreon has addressed these vulnerabilities in their May 2026 monthly security bulletin, publishing patches for affected versions. Organizations running vulnerable versions of Centreon Web should prioritize applying the security updates to mitigate the risk of unauthorized remote code execution and potential compromise of their monitoring infrastructure.

Given that Centreon is commonly deployed in enterprise environments for infrastructure monitoring, successful exploitation could provide attackers with access to sensitive operational data and potentially enable lateral movement within monitored networks. The combination of remote code execution capability with security policy bypass represents a significant threat to affected installations.

Detection guidance

Suspicious Child Process Spawned by Web Server Process (Possible Centreon RCE Exploitation)

ATT&CK T1190

Detects a web server or PHP-FPM process spawning a shell or command interpreter, consistent with exploitation of a PHP web application RCE vulnerability such as those in Centreon Web. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned by Web Server Process
id: 813f288e-1921-568f-a4e9-5d1d53fbad44
status: experimental
description: 'Detects command interpreters or shells spawned as children of web server
  or PHP-FPM processes.

  This pattern is consistent with exploitation of remote code execution vulnerabilities
  in

  PHP-based web applications such as Centreon Web, where an attacker-controlled request
  causes

  the web server process to execute an OS command.

  '
references:
- CERT-FR advisory on Centreon Web RCE vulnerabilities
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    - /nginx
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
    - /zsh
    - /perl
    - /python
    - /python3
    - /curl
    - /wget
    - /nc
    - /ncat
  filter:
    CommandLine|contains:
    - logrotate
    - healthcheck
    - graceful
  condition: selection_parent and selection_child and not filter
falsepositives:
- Legitimate PHP scripts that invoke shell utilities for scheduled monitoring tasks
  (e.g. Centreon plugins executing shell/nagios plugin scripts)
- Web server health check or log rotation scripts
level: high

Reconnaissance Commands Executed by Web Application Service Account (Post-Exploitation of Web RCE)

ATT&CK T1190

Detects common reconnaissance commands (whoami, id, uname, hostname) executed under a web server service account, indicating potential post-exploitation activity following a web application RCE such as the Centreon Web vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Reconnaissance Commands Executed by Web Server Service Account
id: 5e7f6b01-f3b9-5af4-93ee-9d0d84b11a33
status: experimental
description: 'Detects execution of basic system reconnaissance commands (whoami, id,
  uname, hostname) run

  by a low-privilege web application account (e.g. www-data, apache, nginx, centreon).
  This is a

  common early-stage post-exploitation behavior following successful exploitation
  of a remote

  code execution vulnerability in a public-facing web application such as Centreon
  Web.

  '
references:
- CERT-FR advisory on Centreon Web RCE vulnerabilities
author: Vorant
tags:
- attack.t1190
- attack.discovery
logsource:
  category: process_creation
  product: linux
detection:
  selection_user:
    User:
    - www-data
    - apache
    - nginx
    - centreon
    - centreon-web
  selection_cmd:
    Image|endswith:
    - /whoami
    - /id
    - /uname
    - /hostname
    - /uname -a
  condition: selection_user and selection_cmd
falsepositives:
- Centreon plugin scripts or monitoring probes that legitimately gather host facts
  under the service account
- Configuration management or provisioning tools running under the same service account
level: medium

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0659

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free