EUVD-2026-46388
GHSA-c67m-vcwh-5fgw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable REST endpoint with low complexity and no user interaction, but a valid low-privileged account is required so PR:L; full command execution yields C/I/A High.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.
AnalysisAI
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through asset filter parameters on the Analysis REST endpoint, breaking out of command argument handling to run arbitrary commands as a low-privileged OS user. The CVSS 4.0 base score of 9.4 reflects high confidentiality, integrity, and availability impact plus a scope change to subsequent systems, though exploitation requires low-level authenticated access (PR:L). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Security Center session at low privilege (CVSS PR:L) and network reachability to the Analysis REST endpoint; the attacker must be able to submit crafted asset filter parameters carrying shell metacharacters that escape command argument handling. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority for organizations running Security Center, but not a mass-exploitation, drop-everything internet worm scenario. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a low-privileged Security Center login (via phishing, credential reuse, or an insider) submits an asset filter parameter to the Analysis REST endpoint containing shell metacharacters such as ; or $(...), causing the injected command to execute on the host as the service OS user. From there they read scan results and stored scan credentials or pivot deeper into the network. … |
| Remediation | Consult Tenable advisory TNS-2026-19 (https://www.tenable.com/security/tns-2026-19) and upgrade to the fixed Security Center release specified there - the exact patched version is not included in the provided data, so it must be taken from the advisory rather than assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Tenable Security Center instances and current versions, restrict authenticated access to essential security staff only by auditing and revoking unnecessary credentials, and enable comprehensive REST API audit logging with focus on asset filter parameters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Center
View allOS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell comm
Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating sy
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-sys
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrati
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-a
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacke
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command exec
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file uplo
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their a
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access
Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today