EUVD-2026-46394
GHSA-xjp8-j4mm-q4h6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable authenticated web feature (AV:N/AC:L/PR:L/UI:N); blind read-only SQLi yields high confidentiality, limited integrity, no availability, no scope change.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
3DescriptionCVE.org
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.
AnalysisAI
Blind SQL injection in Tenable Security Center (formerly Tenable.sc/SecurityCenter) lets an authenticated, low-privileged user manipulate report filtering parameters to read unauthorized data from the backend database. Because the vulnerable manager aggregates vulnerability, asset, and scan data across the enterprise, a successful attacker can exfiltrate sensitive security posture information belonging to other users and organizations. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was self-reported by Tenable under advisory TNS-2026-19.
Technical ContextAI
Tenable Security Center is an on-premises vulnerability management console that stores scan results, asset inventories, and reporting metadata in a relational database queried by its web/API tier. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied input in the report filtering parameters is concatenated directly into SQL statements rather than passed through parameterized/prepared queries or proper escaping. Because responses do not directly echo query results, exploitation is 'blind' - the attacker infers data by observing boolean/time-based differences in application behavior. The single affected product per the CPE data is cpe:2.3:a:tenable,_inc.:security_center:*:*:*:*:*:*:*:*, spanning unspecified versions up to the fixed release.
RemediationAI
Upgrade to the fixed Tenable Security Center release identified in vendor advisory TNS-2026-19 (https://www.tenable.com/security/tns-2026-19); the exact patched version was not included in the provided data and must be confirmed against that advisory before deployment - no vendor-released fix version is independently confirmed here. Until patched, reduce exposure by restricting network access to the Security Center console and API to trusted management networks or VPN only, tightening account provisioning so only necessary users hold accounts (since exploitation requires an authenticated low-privileged user), and monitoring application/database logs for anomalous report-filter queries or time-based/boolean SQLi patterns; the trade-off of network restriction is reduced remote administrative convenience, and aggressive account de-provisioning may interrupt legitimate analysts.
More in Security Center
View allAuthenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating sy
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrati
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell comm
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-sys
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-a
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacke
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command exec
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file uplo
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their a
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today