EUVD-2026-46394
GHSA-xjp8-j4mm-q4h6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
DeliveryAccess report filtering feature
-
ExploitInject SQL via filter parameters
-
ExecutionInfer data via blind boolean/time responses
-
ImpactExfiltrate unauthorized database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account on Tenable Security Center (CVSS PR:L confirms low-privileged authentication is needed) with the ability to submit report filtering parameters - the report generation/filtering feature is the exact attack surface. The attacker must reach the Security Center web console or API over the network (AV:N), but needs no elevated privileges, no user interaction, and no special non-default configuration beyond having a usable account. Limiting factors: the mandatory valid account rules out unauthenticated internet-wide exploitation, impact is confined to unauthorized database READ (high confidentiality, only low integrity, no availability), and value scales with how much sensitive multi-tenant data the specific deployment stores. |
| Impact | The supplied CVSS 4.0 base score is 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N - network-reachable, low complexity, low privileges required, no user interaction, with high confidentiality impact but only limited integrity and no availability impact, consistent with a read-only blind SQLi. The PR:L requirement is the primary limiting factor: an attacker needs a valid, if unprivileged, account, which caps mass unauthenticated exploitation and reduces real-world urgency versus an unauthenticated RCE. No EPSS score, POC, or KEV status was provided; absence of KEV and POC signals means there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (no conflicts), so this is a genuine-but-moderate priority: important to patch in exposed or multi-tenant deployments, but not an emergency drop-everything issue given the authentication precondition and read-only impact. |
| Exploit ScenarioDerived | A low-privileged analyst or a compromised standard user account submits crafted report filter values that inject boolean or time-based SQL conditions into the backend query. By iterating requests and observing response differences, the attacker reconstructs database contents - for example vulnerability findings or credentials/config data belonging to other organizations in the console. The AV:N/AC:L/PR:L profile means this needs only routine web/API access and no user interaction, though a valid account is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Blind SQL injection in Tenable Security Center (formerly Tenable.sc/SecurityCenter) lets an authenticated, low-privileged user manipulate report filtering parameters to read unauthorized data from the backend database. Because the vulnerable manager aggregates vulnerability, asset, and scan data across the enterprise, a successful attacker can exfiltrate sensitive security posture information belonging to other users and organizations. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was self-reported by Tenable under advisory TNS-2026-19.
RemediationAI
Upgrade to the fixed Tenable Security Center release identified in vendor advisory TNS-2026-19 (https://www.tenable.com/security/tns-2026-19); the exact patched version was not included in the provided data and must be confirmed against that advisory before deployment - no vendor-released fix version is independently confirmed here. Until patched, reduce exposure by restricting network access to the Security Center console and API to trusted management networks or VPN only, tightening account provisioning so only necessary users hold accounts (since exploitation requires an authenticated low-privileged user), and monitoring application/database logs for anomalous report-filter queries or time-based/boolean SQLi patterns; the trade-off of network restriction is reduced remote administrative convenience, and aggressive account de-provisioning may interrupt legitimate analysts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tenable Security Center is an on-premises vulnerability management console that stores scan results, asset inventories, and reporting metadata in a relational database queried by its web/API tier. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied input in the report filtering parameters is concatenated directly into SQL statements rather than passed through parameterized/prepared queries or proper escaping. Because responses do not directly echo query results, exploitation is 'blind' - the attacker infers data by observing boolean/time-based differences in application behavior. The single affected product per the CPE data is cpe:2.3:a:tenable,_inc.:security_center:*:*:*:*:*:*:*:*, spanning unspecified versions up to the fixed release.
Know when Security Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable authenticated web feature (AV:N/AC:L/PR:L/UI:N); blind read-only SQLi yields high confidentiality, limited integrity, no availability, no scope change.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
2DescriptionCVE.org
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.
Executive ViewAI
Tenable Security Center users with low-level system access can bypass authorization controls to view sensitive vulnerability and asset data that should be restricted by role, directly compromising confidentiality of the organization's security posture. Since no public exploit has been identified at time of analysis, the primary risk is from authorized employees misusing their access rather than external threat actors. This vulnerability in a foundational security aggregation tool requires immediate access controls to prevent sensitive compliance data, asset weaknesses, and security assessments from being viewed by users without proper authorization.
No vendor-released patch identified at time of analysis. Implement interim mitigations: restrict low-privileged user permissions to deny access to report filter parameters; deploy database query monitoring and alerting for suspicious activity patterns; enforce principle of least privilege through role-based access controls; consider disabling report functionality for low-privilege accounts if risk tolerance does not permit continued access; implement multi-factor authentication for all administrative access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Security Center
View allAuthenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating sy
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrati
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell comm
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-sys
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-a
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacke
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command exec
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file uplo
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their a
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access
Exploit-DB