Tenable Security Center CVE-2026-19680

Low-privilege authenticated access to Tenable Security Center is required, as confirmed by PR:L in the CVSS vector. Network access to the Security Center web or API endpoint is necessary (AV:N). No special non-default configuration is described as a prerequisite - the vulnerability appears to exist in standard application functionality. Exploitation is limited by the authentication requirement: unauthenticated external attackers cannot exploit this directly. The scope is unchanged (S:U), meaning lateral movement to other systems is not implied by the vulnerability itself.

The CVSS 7.1 score is well-supported by the vector components: network-reachable, low complexity, low-privilege authentication required, no user interaction, with high confidentiality and limited integrity impact. The primary real-world concern is data exfiltration - Security Center stores aggregated vulnerability scan data, asset inventories, and potentially credential or network topology information, making its database a high-value target. No EPSS score was provided, preventing quantitative exploitation-probability comparison; this is a notable data gap. KEV status is absent and no POC is referenced, so exploitation remains speculative rather than confirmed. The PR:L requirement is a meaningful limiting factor - unauthenticated exploitation is not supported by the available data. However, in environments where Security Center accounts are broadly provisioned or shared, this barrier is reduced. The combination of a security-focused product, sensitive database contents, and straightforward network-accessible SQLi warrants treatment as a high-priority remediation item regardless of EPSS signal absence.

An attacker with a valid low-privilege Security Center account submits a crafted SQL payload through a vulnerable input field in the application interface, manipulating the backend query to return rows from tables outside their authorization scope - potentially exposing scan results, asset data, or other tenants' records. No public exploit code has been identified at time of analysis, but the low attack complexity suggests manual exploitation is feasible by an attacker familiar with SQL injection techniques.