Tenable Security Center EUVD-2026-58732

Exploitation requires an authenticated session with the Security Manager role AND at least one 'manage user' permission grant on any group within the Security Center instance. The bypassed control is the group-scoping enforcement - users with this role/permission combination can target accounts in groups other than the one they are authorized to manage. Exploitation is limited to authenticated users; unauthenticated attackers cannot exploit this flaw. The attack is further constrained to network-accessible Security Center instances; air-gapped deployments reduce exposure to internal threat actors only. Non-default limitation: only accounts explicitly granted the Security Manager role with at least one group-level 'manage user' permission are capable of exploitation - standard lower-privilege roles such as Security Analyst are not affected.

The CVSS 4.0 score of 8.6 reflects network accessibility (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and high confidentiality and integrity impact on the vulnerable system. These metrics collectively paint a realistic threat picture: any user with a Security Manager role and a single group-scoped 'manage user' grant can abuse this flaw. The real-world severity is high in environments where Security Center RBAC is relied upon for strict administrative delegation, particularly multi-tenant or managed security service provider (MSSP) deployments where group isolation is a security boundary. No EPSS data was provided; however, the absence of a KEV listing and no known public exploit code suggest opportunistic mass exploitation is not yet occurring. The self-reported nature of the disclosure by Tenable indicates a controlled discovery process. The primary risk is insider threat or privilege creep: a Security Manager legitimately authorized over one group could modify users in sensitive administrative groups, potentially elevating their own or others' access within the platform.

An authenticated Security Manager who legitimately administers a low-privilege user group crafts API or UI requests targeting user accounts in a high-privilege group - such as an administrative or global group - to which they have no authorized access. By exploiting the missing group-scope enforcement, they modify those out-of-scope users' roles, credentials, or group memberships, effectively escalating their own or a colluding account's privileges within Tenable Security Center. No public proof-of-concept exists at time of analysis, but the attack path is straightforward given knowledge of the API structure.