EUVD-2026-58736
GHSA-pgh6-g8gg-ch94
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network delivery with high complexity (token prediction required), no attacker privileges, mandatory victim interaction, and integrity-only impact fully justify all provided metrics.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
3DescriptionCVE.org
An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation.
AnalysisAI
Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22.
Technical ContextAI
Tenable Security Center (CPE: cpe:2.3:a:tenable,_inc.:security_center:*:*:*:*:*:*:*:*) is an on-premises vulnerability management platform. CSRF tokens are server-side nonces embedded in state-changing requests to prevent cross-site request forgery - their security relies entirely on unpredictability. CWE-1270 (Generation of Incorrect Security Tokens) captures the root cause: the token generation algorithm used a predictable method - likely a weak PRNG, timestamp-seeded value, or low-entropy source - reducing the token search space to a range an attacker could feasibly enumerate or predict. An attacker who can determine the likely token value for an active session can craft a malicious request that a victim's browser will submit with valid credentials, bypassing the CSRF defense. The fix involved improving randomness and entropy in token generation, aligning with NIST SP 800-90A recommendations for cryptographically secure PRNGs.
RemediationAI
The primary remediation is to apply the vendor-supplied patch documented in Tenable advisory TNS-2026-22 (https://www.tenable.com/security/tns-2026-22); a specific fixed version number was not included in the available input data and must be confirmed from that advisory. Because the vulnerability is in CSRF token generation, a short-term compensating control is to restrict access to the Security Center web interface to trusted internal network segments or VPN-only paths, reducing the attack surface for the network-delivered social engineering component required by UI:R. Additionally, enforcing short session timeouts reduces the window available for an attacker to predict a token and trick a victim into submitting it before expiration. These mitigations do not eliminate the flaw - patching remains the only definitive fix - but they raise the practical difficulty of exploitation while the patch is staged.
More in Security Center
View allAuthenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating sy
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrati
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell comm
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-sys
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-a
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacke
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command exec
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file uplo
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their a
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access
Same weakness CWE-1270 – Generation of Incorrect Security Tokens
View allShare
External POC / Exploit Code
Leaving vuln.today