Tenable Security Center EUVD-2026-58741

Exploitation requires a valid, authenticated account within Tenable Security Center with sufficient permissions to use the file upload functionality - the CVSS PR:L metric confirms low-privilege (non-administrator) authentication is sufficient. The attacker must be able to reach the Security Center web interface over the network (AV:N), which is typically an internal enterprise application rather than internet-facing. No user interaction from another party is required (UI:N), and attack complexity is low (AC:L), meaning no race condition or specialized environment is needed beyond the authenticated session. Exploitation is limited to users who can authenticate to Security Center - externally unauthenticated attackers and users without file upload access are not directly exposed. The CVSS scope is unchanged (S:U), indicating impact is confined to the Security Center host itself and does not automatically propagate to adjacent systems.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H places this at 8.8 High, reflecting network reachability, low complexity, and full triad impact - but critically requiring low-privilege authentication (PR:L). This distinguishes it from a critical unauthenticated exploit: an attacker must first hold a valid account within Security Center, which is typically restricted to security staff and administrators. No EPSS score was provided in the input data, and the vulnerability does not appear in the CISA KEV catalog, nor is public exploit code reported. Despite the PR:L constraint, the risk is elevated by the nature of the target: Security Center operators often have broad internal network visibility and access to scan credentials, meaning post-exploitation blast radius is significant. The combination of low complexity and no user interaction (UI:N) means that once authenticated, exploitation is straightforward. This should be prioritized for patching in environments where Security Center is accessible to a broad user population or integrated with privileged scan accounts.

An attacker who holds a low-privilege Security Center account - such as a junior analyst or a compromised credential - uploads a file whose name contains shell metacharacters (e.g., a semicolon or backtick followed by a reverse shell command). The server's file upload handler passes the unsanitized filename to a downstream OS-level operation, triggering execution of the injected command in the context of the Security Center process. The attacker gains arbitrary command execution on the server, potentially pivoting to scan credential stores or internal network assets managed by Security Center. No public proof-of-concept code is known at time of analysis.