Unauthenticated configuration import allows administrative account creation using AWIE component

The core of this vulnerability lies in the missing authentication check for critical functions within the Awie import module. An attacker who can exploit this flaw can bypass the intended security controls and gain access to sensitive data or execute unauthorized actions within the Centreon environment. This could include modifying monitoring configurations, accessing confidential reports, or even potentially escalating privileges to gain control of the entire system. The impact is particularly severe given Centreon's role in monitoring critical infrastructure, where unauthorized access could lead to disruptions and data loss. Successful exploitation could mirror the impact of privilege escalation vulnerabilities seen in other monitoring platforms, allowing attackers to gain a foothold and move laterally within the network.

Organizations heavily reliant on Centreon Infra Monitoring for critical infrastructure management are particularly at risk. Environments with legacy configurations or those using shared hosting models where the Centreon instance is not adequately isolated are also more vulnerable. Any deployment utilizing versions 24.04.0 through 25.10.2 is potentially exposed.

1. 2026-01-05Disclosure

   disclosure

1. आरक्षित2025-12-22
2. प्रकाशित2026-01-05
3. संशोधित2026-01-08
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-15026 is to immediately upgrade Centreon Infra Monitoring to version 25.10.2 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing temporary workarounds. While a direct ACL bypass mitigation is difficult without patching, restrict network access to the Awie import module using firewalls or network segmentation to limit the potential attack surface. Review and strengthen existing authentication mechanisms for other Centreon components to reduce the overall risk profile. After upgrading, verify the fix by attempting to access restricted functionality without proper authentication credentials; access should be denied.