EUVD-2026-58729
GHSA-gh84-92j4-rf23
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable admin console access (AV:N/AC:L), but full administrator credentials required (PR:H); impact confined to the vulnerable system with no scope change (S:U).
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered.
AnalysisAI
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command execution by embedding shell metacharacters in application configuration values, which are later executed unsanitized when specific backend operations are triggered. The CWE-78 root cause and the PR:H CVSS 4.0 metric confirm exploitation is gated behind administrator-level access, restricting the realistic attacker population to insiders, compromised admin credentials, or post-escalation actors. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid administrator-level account on Tenable Security Center - confirmed by the CVSS 4.0 PR:H metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.6 reflects full confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H), but the PR:H metric is the critical risk-moderating factor - exploitation is not available to unauthenticated or low-privilege actors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has acquired administrator credentials to Tenable Security Center - through spear-phishing, credential reuse, or post-breach lateral movement - logs into the administrative console and modifies a configuration field to include injected shell commands. When a scheduled backend operation such as a scan job launch or service reload subsequently reads and processes that configuration value, the injected commands execute on the underlying operating system under the Security Center application's runtime privilege level, potentially yielding persistent shell access to the host. |
| Remediation | The primary remediation is to apply the update documented in Tenable advisory TNS-2026-22, available at https://www.tenable.com/security/tns-2026-22. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all Tenable Security Center instances for unauthorized access, review administrator activity logs for anomalies, and verify credential vault integrity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Center
View allOS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell comm
Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating sy
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-sys
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrati
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-a
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacke
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file uplo
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their a
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access
Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today