SQL injection in Tenable Security Center ticketing REST API (CVE-2026-64877)

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API of Tenable Security Center to access sensitive data stored in the appliance database. The vulnerability is rated High severity with a CVSS v3 base score of 8.4 and is addressed in stand-alone security patch SC202607.1. Affected versions: - 6.6.0 - 6.7.2 - 6.8.0 We recommend updating to: SC202607.1. CVSS 9.4 · our assessment: act_now Reference: https://www.tenable.com/security/tns-2026-19 Details: https://vuln.today/cve/CVE-2026-64877