Command injection in Tenable Security Center via Analysis REST endpoint (CVE-2026-64878)

CVE-2026-64878 is a command injection vulnerability in Tenable Security Center in which unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling. A low-privileged, remote attacker can exploit this flaw via the Analysis REST endpoint to achieve remote code execution as a low-privileged OS user. The vulnerability carries a CVSS v3 base score of 9.9 (Critical). Affected versions: - 6.6.0 - 6.7.2 - 6.8.0 We recommend updating to: SC202607.1. CVSS 9.4 · our assessment: act_now Reference: https://www.tenable.com/security/tns-2026-19 Details: https://vuln.today/cve/CVE-2026-64878