Skip to main content

Security Center CVE-2026-2698

MEDIUM
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-02-23 vulnreport@tenable.com
Authentication Bypass Security Center
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
CVE Published
Feb 23, 2026 - 17:23 nvd
MEDIUM 6.5

DescriptionCVE.org

An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.

AnalysisAI

Security Center's access control implementation fails to properly restrict authenticated users to their authorized scope, allowing privilege escalation to view sensitive data. An attacker with valid credentials can bypass authorization checks to access confidential information outside their assigned permissions. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-639 (Authorization Bypass Through User-Controlled Key). Affects Security Center. An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Security Center

View all
CVE-2023-1522 HIGH
8.8 Apr 05

SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
CVE-2020-25045 HIGH
7.8 Sep 02

Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were
CVE-2024-1367 HIGH
7.2 Feb 14

A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Se
CVE-2024-5759 MEDIUM
6.3 Jun 12

An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker
CVE-2024-1891 MEDIUM
5.4 Jun 12

A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker co
CVE-2024-1471 MEDIUM
4.8 Feb 14

An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Secu
CVE-2026-2697 LOW
2.1 Feb 23

Authenticated users of Security Center can manipulate the 'owner' parameter to gain unauthorized elevated privileges thr

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8
CVE-2024-27730 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-2698 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy