CVE-2026-64879 CRITICAL CVSS 9.4 Security Center Verified Advisory

Command injection in Tenable Security Center audit file upload (CVE-2026-64879)

Command Injection File Upload Security Center Tenable Inc

Tenable Security Center does not properly sanitize filenames supplied during audit file upload before using them in system command execution. An attacker can inject shell metacharacters into a supplied filename to achieve command injection. This issue carries a CVSS v3 base score of 9.9 (Critical). Affected versions: - 6.6.0 - 6.7.2 - 6.8.0 We recommend updating to: SC202607.1. CVSS 9.4 · our assessment: act_now Reference: https://www.tenable.com/security/tns-2026-19 Details: https://vuln.today/cve/CVE-2026-64879

Verified by vuln.today against published advisories.

Affected versions

– 6.6.0
– 6.7.2
– 6.8.0

Fixed in: SC202607.1

Full CVE analysis Reference Published Jul 21, 2026

← All verified advisories