CVE-2025-15026

CRITICAL

Centreon Awie < 24.04.3 - Missing Authentication

Title source: rule

Description

Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.

References (2)

[Release Notes] https://github.com/centreon/centreon/releases

[Patch, Vendor Advisory] https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-15026-centreon-awie-critical-severity-5357

Scores

CVSS v3 9.8

EPSS 0.0003

EPSS Percentile 9.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-306

Status published

Affected Products (1)

centreon/awie < 24.04.3

Timeline

Published Jan 05, 2026

Tracked Since Feb 18, 2026