Tenable Security Center EUVD-2026-58736

The victim must be an authenticated Tenable Security Center user with an active session at the time of the attack - an unauthenticated user's browser cannot carry the session credentials needed for the forged request to succeed. The attacker must be able to predict or enumerate the CSRF token generated for that session, which requires knowledge of or access to the weak token generation algorithm and sufficient time to compute candidates before session expiration. User interaction is a hard requirement: the victim must be socially engineered into visiting an attacker-controlled page or clicking a crafted link while authenticated. No special server-side configuration or non-default deployment mode is cited as a prerequisite - the flaw appears present in standard deployments. Exploitation is limited by the high attack complexity (AC:H from CVSS), the requirement for victim interaction (UI:R), and the time-bounded nature of CSRF tokens.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) scores 5.3 Medium, accurately reflecting a real but conditional attack path: high complexity (AC:H) acknowledges that the attacker must successfully predict or enumerate the token before the victim session expires, which is non-trivial even with a weak PRNG. User interaction (UI:R) is a firm gating requirement - the victim must be authenticated and must trigger the forged request, typically by visiting an attacker-controlled page. No EPSS data was provided in the input, and the absence of a KEV listing and public POC suggests this has not seen broad exploitation. The integrity impact is rated High (I:H), which is appropriate given that a successful CSRF on a vulnerability management platform could trigger privileged actions such as suppressing scan findings or modifying scan policies - consequences that materially affect an organization's security posture. The wildcard version range in the CPE (*) means the full affected version scope is not bounded by NVD data alone and should be confirmed against TNS-2026-22. Overall, this is a real but exploitation-constrained vulnerability: the attack requires timing, token prediction, and user interaction simultaneously, making opportunistic mass exploitation unlikely - but a targeted attacker against a known Security Center deployment could feasibly chain it with social engineering.

An attacker identifies that a target organization runs Tenable Security Center and knows or infers the weak PRNG algorithm used for CSRF token generation. The attacker crafts a malicious webpage that pre-computes probable CSRF token values for the victim's active session and embeds a forged request - for example, to disable a scan policy or suppress vulnerability findings. The attacker then delivers the link to an authenticated Security Center administrator via phishing; when the administrator visits the page while logged in, the browser automatically submits the forged request with valid session cookies and a predicted CSRF token, completing the attack. No public POC has been identified at time of analysis.