EUVD-2026-46388
GHSA-c67m-vcwh-5fgw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
DeliveryReach Analysis REST endpoint
-
ExploitInject shell metacharacters in asset filter
-
ExecutionEscape command argument handling
-
PersistExecute code as OS user
-
ImpactAccess scan data and pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Security Center session at low privilege (CVSS PR:L) and network reachability to the Analysis REST endpoint; the attacker must be able to submit crafted asset filter parameters carrying shell metacharacters that escape command argument handling. Limiting factors: the attacker needs valid credentials for a low-privileged account (not unauthenticated), the malicious input must reach the specific Analysis endpoint's asset filter parameter, and code executes only as the low-privileged service OS user rather than root, so initial impact is bounded by that account's permissions until further escalation. |
| Impact | This is a genuine priority for organizations running Security Center, but not a mass-exploitation, drop-everything internet worm scenario. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network-reachable, low-complexity exploitation with no user interaction, and the high VC/VI/VA plus subsequent-system impact (SC/SI/SA:H) drive the 9.4 score; however PR:L means the attacker must already hold a valid low-privileged Security Center account, which materially reduces the exploitable population versus an unauthenticated flaw. No EPSS score, KEV listing, or POC was provided, so real-world exploitation probability cannot be quantified from the input - treat exploitation likelihood as unknown rather than high. The subsequent-system HIGH ratings (SC/SI/SA) suggest the vendor assessed impact extending beyond the vulnerable process boundary, which is notable because Security Center holds sensitive scan data and credentials that could enable lateral movement. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privileged Security Center login (via phishing, credential reuse, or an insider) submits an asset filter parameter to the Analysis REST endpoint containing shell metacharacters such as ; or $(...), causing the injected command to execute on the host as the service OS user. From there they read scan results and stored scan credentials or pivot deeper into the network. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through asset filter parameters on the Analysis REST endpoint, breaking out of command argument handling to run arbitrary commands as a low-privileged OS user. The CVSS 4.0 base score of 9.4 reflects high confidentiality, integrity, and availability impact plus a scope change to subsequent systems, though exploitation requires low-level authenticated access (PR:L). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
RemediationAI
Consult Tenable advisory TNS-2026-19 (https://www.tenable.com/security/tns-2026-19) and upgrade to the fixed Security Center release specified there - the exact patched version is not included in the provided data, so it must be taken from the advisory rather than assumed. Because exploitation requires an authenticated low-privileged account, effective compensating controls until patching include restricting network access to the Security Center web/REST interface to trusted management networks only, tightening and auditing user accounts to remove unnecessary low-privilege logins, and monitoring the Analysis REST endpoint for filter parameters containing shell metacharacters; note that restricting network access may disrupt legitimate remote analysts and API integrations, so scope allowlists to known operator ranges.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Security Center is Tenable's on-premises vulnerability-management console that aggregates Nessus scan data and exposes analysis and reporting through a REST API. The root cause is CWE-78 (OS Command Injection): user-supplied asset filter parameters submitted to the Analysis endpoint are passed into an underlying OS command without adequate sanitization or safe argument separation, so shell metacharacters (e.g., ;, |, &, `, $()) escape the intended argument boundary and are interpreted by the shell. The affected CPE is cpe:2.3:a:tenable,_inc.:security_center, and the injected commands execute with the privileges of the OS account running the affected component rather than root.
Know when Security Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable REST endpoint with low complexity and no user interaction, but a valid low-privileged account is required so PR:L; full command execution yields C/I/A High.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
3DescriptionCVE.org
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.
Executive ViewAI
Tenable Security Center-the enterprise platform for managing vulnerability risk-contains a critical remote code execution flaw (CVE-2026-64878, CVSS 9.4) exploitable by users with valid employee credentials; no vendor patch currently exists, though no public exploit identified at time of analysis. Compromise would grant attackers command execution on security infrastructure, potentially blinding the organization to threats across its entire system estate. Immediate credential lockdown and network segmentation are required to minimize exposure window duration.
Network segmentation restricting Security Center access to authorized security operations systems; mandatory multi-factor authentication and credential rotation for all user accounts; disable Analysis REST API if not required for operational integrations; comprehensive REST API audit logging with real-time alerts for parameter anomalies; restrict network routing to prevent lateral movement from compromised platform; maintain offline backup of vulnerability data to preserve security posture visibility if compromise occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Security Center
View allAuthenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating sy
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrati
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell comm
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-sys
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-a
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacke
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command exec
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file uplo
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their a
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access
Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were
Exploit-DB