Tenable Security Center EUVD-2026-58738

Exploitation requires an authenticated, non-administrative user account on the Tenable Security Center application - unauthenticated or anonymous access is not sufficient, and administrative accounts are out of scope since they already have broader visibility. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates no special network position, configuration state, or attack prerequisites are required beyond low-level credentials. Exploitation is concretely limited by: (1) the need for a valid non-admin application account, which constrains the attacker pool to insiders or compromised credential scenarios; (2) impact restricted to read-only disclosure of settings data - no modification or disruption of operations is possible; and (3) the disclosed data is scoped to application settings rather than scan results, credentials, or underlying OS data. The vulnerability is most impactful when Security Center is deployed in a multi-organization or scope-partitioned configuration where scope isolation is a meaningful security boundary between business units or clients.

The CVSS 4.0 score of 5.3 (Medium) is consistent with the vulnerability's limited impact profile: confidentiality impact is low (VC:L), with no integrity (VI:N) or availability (VA:N) impact, and no subsequent-system scope (SC:N/SI:N/SA:N). The attack vector is network (AV:N), complexity is low (AC:L), and no attack requirements exist (AT:N), which means an attacker does not need to engineer special conditions beyond obtaining a non-admin account. The authentication requirement (PR:L) is the primary limiting factor - unauthenticated exploitation is not possible. No EPSS data was provided, preventing probabilistic exploitation likelihood assessment. This vulnerability is not listed in the CISA KEV catalog, and no proof-of-concept exploit has been identified, indicating no confirmed active exploitation at time of analysis. In practical terms, this represents a horizontal privilege escalation within the application's access control model rather than a systemic compromise - the real-world risk is highest in multi-tenant or multi-organization Security Center deployments where different business units share a single instance and scope separation is a meaningful security boundary. Organizations with a single organizational scope or where all users are effectively trusted peers face lower effective risk.

An attacker who has obtained or been legitimately issued a non-administrative Tenable Security Center account - such as a limited analyst or scan operator - authenticates to the Security Center web interface and queries settings endpoints or navigates configuration panels that belong to organizational scopes they have not been assigned to. This could expose scan policy configurations, organizational settings, or administrative parameters from peer scopes. No public exploit code has been identified, but the low attack complexity means exploitation would require no specialized tooling beyond a standard browser or API client.