EUVD-2026-58738
GHSA-f5m5-34r9-8764
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated non-admin access required (PR:L); read-only settings disclosure yields C:L; no integrity, availability, or scope-change impact confirmed.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope.
AnalysisAI
Improper access control in Tenable Security Center enables authenticated non-administrative users to read application settings that fall outside their assigned organizational or role-based scope, constituting an unauthorized information disclosure. The vulnerability requires only a low-privileged authenticated account and is exploitable over a network with no user interaction or special triggering conditions, per the CVSS 4.0 vector (AV:N/AC:L/PR:L). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated, non-administrative user account on the Tenable Security Center application - unauthenticated or anonymous access is not sufficient, and administrative accounts are out of scope since they already have broader visibility. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) is consistent with the vulnerability's limited impact profile: confidentiality impact is low (VC:L), with no integrity (VI:N) or availability (VA:N) impact, and no subsequent-system scope (SC:N/SI:N/SA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or been legitimately issued a non-administrative Tenable Security Center account - such as a limited analyst or scan operator - authenticates to the Security Center web interface and queries settings endpoints or navigates configuration panels that belong to organizational scopes they have not been assigned to. This could expose scan policy configurations, organizational settings, or administrative parameters from peer scopes. … |
| Remediation | Consult Tenable advisory TNS-2026-22 at https://www.tenable.com/security/tns-2026-22 for the primary fix and any specific patched version details, as no exact fix version is confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Center
View allOS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell comm
Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating sy
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-sys
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrati
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-a
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacke
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command exec
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file uplo
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their a
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today