Tenable Security Center EUVD-2026-46358

The attacker must possess a valid authenticated Security Center account of at least non-admin privilege (CVSS PR:L) and network reachability to the appliance's ticketing REST API; the concrete prerequisite is an authenticated session able to reach the ticketing API on a Security Center instance running a version earlier than 6.8.0. What LIMITS exploitation: it is not pre-authentication, so an anonymous internet attacker cannot exploit it without first obtaining credentials; no admin rights are needed and no user interaction is required (UI:N), so any low-privileged account suffices. There is no indication a non-default configuration or specific platform is required beyond having the ticketing feature reachable.

The vendor CVSS 4.0 base score is 9.4 (critical) with vector AV:N/AC:L/AT:N/PR:L/UI:N and high impact across VC/VI/VA plus subsequent-system metrics. The network vector, low attack complexity, and no-user-interaction requirement make exploitation straightforward for anyone who already holds a low-privileged account (PR:L, i.e. authenticated). The mitigating factor is precisely that PR:L: this is not a pre-authentication internet-facing bug, so an attacker needs a valid non-admin login, which meaningfully narrows the realistic threat to insiders, credential-thieves, or environments with broadly issued accounts. No EPSS score, KEV listing, or public POC was provided, so exploitation-probability signals are absent; treat the 9.4 as a capability ceiling rather than evidence of imminent mass exploitation. The vendor's own VI:H/VA:H rating implies write/availability impact broader than the description's read-only 'access sensitive data' wording - this is a discrepancy worth verifying against advisory TNS-2026-19 before assuming full integrity/availability compromise.

A user holding an ordinary non-admin Security Center login (for example a scan operator or a compromised analyst account) sends crafted parameters to the ticketing REST API, causing injected SQL to execute against the appliance database. The attacker retrieves sensitive stored data such as vulnerability findings, asset inventories, or configuration held in the database, all from a legitimate authenticated session. No public POC is identified at time of analysis, and the low attack complexity means a knowledgeable insider needs no special timing or configuration.