Tenable Security Center EUVD-2026-58745

Exploitation requires an authenticated session on the Tenable Security Center console with at least low-privilege access (CVSS PR:L), plus the ability to reach the file-upload processing feature within the application. The attacker must submit a specially crafted file (per the description) whose handling injects OS commands; no user interaction from a victim and no elevated/admin role is required. Limiting factors: valid credentials are mandatory (this is not unauthenticated), and network reachability to the console's web interface is needed - consoles restricted to isolated management networks are substantially harder to reach.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding full compromise of both the vulnerable and subsequent systems - a coherent, high-severity profile consistent with the 9.4 score. The single meaningful barrier is authentication: PR:L means the attacker must already hold a valid, low-privilege account on the console, which reduces exposure versus a fully unauthenticated bug but is a weak barrier where accounts are broadly provisioned or credentials are reused. No EPSS score, POC, or KEV entry was provided, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis; the risk driver here is impact severity and low attacker prerequisites rather than confirmed in-the-wild activity. Note that Security Center itself is a high-value target - a security tool with credentialed access to scan data across the environment - so a foothold here has outsized blast radius even absent mass exploitation signals.

A low-privileged analyst account - obtained via credential reuse, phishing, or an over-provisioned internal role - logs into the Security Center web console and uploads a crafted file whose contents or metadata inject shell metacharacters into a command executed server-side. The injected command runs on the underlying OS as the Security Center service account, giving the attacker a shell on the host and access to stored scan data and credentials. No public exploit is identified at time of analysis, but low attack complexity means a working technique would be straightforward to weaponize.