{"id":"CVE-2026-11587","aliases":[],"cve":{"records":[{"id":"CVE-2026-11587","source":"Centreon","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-08T13:12:19.431Z","published":"2026-10-29T16:38:39.793Z","modified":"2026-10-30T17:17:16.870Z"}],"publishers":[{"name":"Centreon","role":"CNA","organizationId":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","modified":"2026-10-29T16:38:39.793Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:17:16.870Z"}],"references":[{"url":"https://thewatch.centreon.comundefined","tags":["vendor-advisory"],"source":"Centreon"},{"url":"https://github.com/centreon/centreon/releases","tags":["release-notes"],"source":"Centreon"}],"weaknesses":[{"id":"CWE-89","description":"CWE-89 SQL Injection","source":"Centreon"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T17:17:03.866596Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0","titleSource":"Centreon","descriptionSource":"Centreon","description":"SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database","score":7.2,"severity":"high","published":"2026-10-29T16:38:39.793Z","modified":"2026-10-30T17:17:16.870Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Centreon","name":"Centreon","platforms":[],"versions":[{"version":"25.10","status":"affected","lessThan":"centreon-web-25.10.15","versionType":"custom"},{"version":"24.10","status":"affected","lessThan":"centreon-web-24.10.28","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Centreon","url":"https://www.cve.org/CVERecord?id=CVE-2026-11587"}],"remediation":[],"references":["https://thewatch.centreon.comundefined","https://github.com/centreon/centreon/releases"],"sources":[{"name":"CVE","id":"CVE-2026-11587","modified":"2026-10-30T17:17:16.870Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-11587"}],"assessments":[{"source":"Centreon","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2}],"sourceAffected":[],"observedAt":"2026-10-30T19:26:49.893Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T10:25:41.007Z","attemptedAt":"2026-10-30T10:25:41.007Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T10:25:40.411Z","attemptedAt":"2026-10-30T10:25:40.411Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T10:25:42.807Z","attemptedAt":"2026-10-30T10:25:42.807Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T10:25:39.959Z","attemptedAt":"2026-10-30T10:25:39.959Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-c9w7-ppf8-758c","url":"https://github.com/advisories/GHSA-c9w7-ppf8-758c","modified":"2026-10-29T18:31:19Z","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T10:25:40.411Z"},{"source":"NVD","id":"CVE-2026-11587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11587","modified":"2026-10-29T17:18:08.167","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T10:25:41.007Z"},{"source":"ENISA EUVD","id":"EUVD-2026-113220","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113220","modified":"Oct 29, 2026, 4:38:39 PM","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T10:25:42.807Z"}],"aiSummary":{"text":"Centreon 25.10 before 25.10.15 and 24.10 before 24.10.28 are affected by SQL injection, allowing authenticated users with ACL management access to read and modify the database. An attacker needs access to ACL management. The weakness is SQL injection.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:59:31.837Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-11587"}]}}