EUVD-2026-46397
GHSA-737x-8xqc-h3gh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Security Center (PR:L)
-
DeliveryUpload audit file with metacharacter-laden filename
-
ExploitFilename reaches unsanitized system command
-
ExecutionInjected shell commands execute on appliance
-
ImpactChain related flaw to full code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Tenable Security Center account (PR:L) with access to the audit file upload handler, and the attacker must supply a crafted filename containing shell metacharacters. Per the description, full command injection is realized only 'when chained with a related vulnerability,' so this CVE is a component of a chain rather than a standalone remote code execution primitive. Limiting factors: valid credentials and permission to reach the audit upload feature are needed, no user interaction from a victim is required (UI:N), and the network attack vector means the management interface must be reachable by the attacker. The dependency on a second chained vulnerability further constrains practical standalone exploitation. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 High: network-reachable, low complexity, no user interaction, but requiring low-level privileges (PR:L), with high confidentiality, integrity, and availability impact and no scope change to other systems. The PR:L requirement is the key mitigating factor - an attacker must already be an authenticated Security Center user with access to the audit file upload function, which meaningfully narrows the threat versus a fully unauthenticated bug. No EPSS score, SSVC decision, or KEV entry was provided, and there is no evidence of public proof-of-concept, so real-world exploitation pressure appears lower than the raw score suggests. One notable caveat: the description states command injection is achieved 'when chained with a related vulnerability,' meaning standalone exploitability of this CVE alone may be limited - verify the chaining partner and prerequisites with the Tenable advisory before assuming turnkey RCE. |
| Exploit ScenarioDerived | An attacker holding a low-privileged authenticated Security Center account uploads an audit file whose filename embeds shell metacharacters (for example a trailing '; command' or '$(command)' construct). When the unsanitized filename is passed into a system command, the injected payload runs on the appliance with the service's privileges, and by chaining the referenced companion flaw the attacker escalates this into reliable code execution. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 21, 2026
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file upload handler, which fails to sanitize filenames and lets shell metacharacters reach a system command call. Rated CVSS 4.0 8.7 (High), the flaw is described as reaching full command execution when chained with a related vulnerability, giving an attacker code execution on the appliance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Earlier versions of this analysis (1)
Command injection in Tenable Security Center's audit file upload handler allows an authenticated user (PR:L) to inject shell metacharacters via unsanitized filenames that flow into OS command execution, yielding full compromise of the appliance (CVSS 8.8, C:H/I:H/A:H). The flaw is described by Tenable as requiring chaining with a related vulnerability to be exploited. At time of analysis there is no public exploit identified and it is not listed in CISA KEV; no EPSS score was provided in the input.
RemediationAI
Apply the fixed release identified in Tenable's advisory tns-2026-19 (https://www.tenable.com/security/tns-2026-19); the exact patched version is not present in the provided data and must be read directly from that advisory rather than assumed. As compensating controls until patched, restrict which authenticated roles can access the audit file upload feature and tighten Security Center account provisioning so only trusted administrators hold upload privileges (trade-off: may disrupt legitimate audit-file workflows); place the Security Center management interface behind network access controls so only administrative hosts can reach it (trade-off: added operational friction for remote admins); and monitor the appliance for anomalous child processes or shell invocations spawned by the Security Center service to detect injection attempts. Because exploitation is described as requiring chaining with a related vulnerability, also ensure any companion advisory items from Tenable are remediated together.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Tenable Security Center, the on-premises console for aggregating and managing vulnerability scan data (identified via cpe:2.3:a:tenable,_inc.:security_center). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where user-controlled filenames from the audit file upload feature are passed into a system shell without escaping or allow-listing. Because shell metacharacters (such as ;, |, &, $(), backticks) are not neutralized, crafted filenames break out of the intended command context and inject attacker-chosen commands, which the underlying OS executes with the privileges of the Security Center service.
Know when Security Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable audit upload needs an authenticated low-privileged account (PR:L) and no user interaction; command injection yields high C/I/A with no scope change to other systems.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
3DescriptionCVE.org
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.
Executive ViewAI
Tenable Security Center (CVSS 8.7) contains an authenticated vulnerability in its audit file upload handler that enables credentialed users to achieve remote code execution on the appliance, directly compromising organizational vulnerability management infrastructure. While no public exploit has been identified, security teams must implement immediate access restrictions to protect this critical security tool.
No vendor-released patch identified at time of analysis. Implement network-level access controls: restrict the upload handler to trusted IP addresses; disable audit upload functionality if operationally feasible. At the application layer: implement filename validation rejecting shell metacharacters and command-like patterns; enforce strict file-type restrictions. Procedurally: enforce multi-factor authentication for administrators; minimize upload permission scope; establish continuous monitoring of upload activity for exploitation patterns; maintain detailed audit logs of all upload operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
More in Security Center
View allAuthenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating sy
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrati
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell comm
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-sys
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-a
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacke
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command exec
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their a
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access
Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were
Exploit-DB