Tenable Security Center CVE-2026-19628

Exploitation requires a valid administrator-level account on Tenable Security Center - confirmed by the CVSS 4.0 PR:H metric. The attacker must have write access to application configuration values, which is a capability restricted to administrator roles. Exploitation is additionally conditioned on a specific backend operation being triggered after the configuration modification; the injection payload does not execute at write time, meaning exploitation is either time-delayed (waiting for a scheduled operation) or requires the attacker to initiate a triggering action. What limits exploitation: unauthenticated attackers cannot exploit this vulnerability; lower-privileged authenticated users without configuration write access cannot exploit it; and exploitation requires either patience for a scheduled trigger or the ability to manually initiate the relevant backend operation. These conditions mean the realistic attacker population is confined to malicious insiders with admin rights, actors who have successfully compromised administrator credentials, or attackers who have previously escalated privileges to the administrator role through a separate vulnerability.

The CVSS 4.0 base score of 8.6 reflects full confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H), but the PR:H metric is the critical risk-moderating factor - exploitation is not available to unauthenticated or low-privilege actors. No EPSS data was supplied, so exploitation probability cannot be quantified statistically; the absence of a KEV listing and public POC further suggests this is not currently subject to opportunistic mass exploitation. That said, even a mid-sized municipal IT team in tczew should treat this as urgent given the strategic value of a Security Center instance: it typically holds authenticated scan credentials, full network topology data, and vulnerability inventories for an entire enterprise - a compromised instance is a highly privileged lateral movement platform, not merely an isolated asset. The SC:N/SI:N/SA:N subsequent-system impact metrics in CVSS 4.0 may technically understate this cascading risk. No CVSS 3.1 vector was provided; the independently assessed 3.1 vector (see assessed_cvss_vector) yields a base score of approximately 7.2, consistent with the 4.0 rating after privilege weighting. No conflicting signals between the CVSS vector and description were identified - the network attack vector is consistent with web-based admin console access.

An attacker who has acquired administrator credentials to Tenable Security Center - through spear-phishing, credential reuse, or post-breach lateral movement - logs into the administrative console and modifies a configuration field to include injected shell commands. When a scheduled backend operation such as a scan job launch or service reload subsequently reads and processes that configuration value, the injected commands execute on the underlying operating system under the Security Center application's runtime privilege level, potentially yielding persistent shell access to the host.