Blind SQL injection in Tenable Security Center (CVE-2026-64880)

Tenable Security Center contains a blind SQL injection vulnerability in which unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries. An authenticated remote attacker could exploit this flaw to perform unauthorized database read access. The vulnerability is rated High with a CVSS v3 base score of 7.1. Affected versions: - 6.6.0 - 6.7.2 - 6.8.0 We recommend updating to: SC202607.1. CVSS 7.1 · our assessment: this_week Reference: https://www.tenable.com/security/tns-2026-19 Details: https://vuln.today/cve/CVE-2026-64880