EUVD-2026-58741
GHSA-85pp-h4r3-7q84
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible web application requiring low-privilege authentication; low complexity filename injection yields full system impact; no scope change as exploitation is confined to the Security Center host.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.
AnalysisAI
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacker to execute arbitrary OS commands on the underlying server. The root cause is insufficient sanitization of user-supplied filenames before they are passed to a downstream shell-invocable operation, classified under CWE-78. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated account within Tenable Security Center with sufficient permissions to use the file upload functionality - the CVSS PR:L metric confirms low-privilege (non-administrator) authentication is sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H places this at 8.8 High, reflecting network reachability, low complexity, and full triad impact - but critically requiring low-privilege authentication (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds a low-privilege Security Center account - such as a junior analyst or a compromised credential - uploads a file whose name contains shell metacharacters (e.g., a semicolon or backtick followed by a reverse shell command). The server's file upload handler passes the unsanitized filename to a downstream OS-level operation, triggering execution of the injected command in the context of the Security Center process. … |
| Remediation | Consult the Tenable advisory TNS-2026-22 at https://www.tenable.com/security/tns-2026-22 for the specific patched version and upgrade instructions, as the exact fixed release is not independently confirmed from available input data - apply the vendor-recommended update immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately restrict file upload functionality in Tenable Security Center to administrative users only and implement network access controls limiting access to authorized personnel. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Center
View allOS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell comm
Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating sy
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-sys
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrati
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-a
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command exec
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file uplo
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their a
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access
Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were
Same weakness CWE-78 – OS Command Injection
View allSame technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today