Tenable Security Center CVE-2026-19631

Exploitation requires an authenticated session with administrator-level privileges within Tenable Security Center, accessible over the network. The CVSS PR:H metric confirms no path to unauthenticated exploitation exists for this vulnerability itself. No special non-default configuration is required beyond holding valid administrator credentials. Limiting factors: exploitation is bounded entirely to actors who already possess or can steal administrator-level access; an attacker without such credentials cannot exploit this vulnerability. Impact is further constrained to read-only database access (C:H, I:N, A:N) - no data modification or service disruption is possible through this vector alone.

The CVSS base score of 4.9 (Medium) accurately reflects the high privilege requirement (PR:H), which substantially limits the realistic attack surface to authenticated administrators or sessions obtained via credential theft or session hijacking. The CVSS confidentiality impact is rated High (C:H) with no integrity or availability impact, consistent with a read-only SQL injection. No EPSS data was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no POC is publicly identified, both of which support a measured response over emergency patching. However, the 'Authentication Bypass' tag warrants scrutiny: if the extracted credentials enable authentication into connected infrastructure (scanners, Active Directory, cloud platforms), the effective blast radius exceeds what the CVSS score alone conveys. This is a genuine priority for organizations where Security Center holds privileged credentials, but not an emergency for those who do not store sensitive credentials in the platform or who enforce strict admin account controls.

An attacker who has obtained administrator credentials to Tenable Security Center - whether through phishing, credential stuffing, or a compromised privileged workstation - logs into the web interface and submits a crafted SQL payload through a vulnerable input field. The payload causes the database to return stored scan credentials (e.g., SSH private keys or Windows domain account passwords) in the application response. The attacker then uses those credentials to authenticate directly into managed assets or Active Directory, bypassing the need to exploit those systems directly.