EUVD-2026-58748
GHSA-p62v-hxp2-pv79
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Security Center web interface
-
DeliverySubmit request with shell metacharacters
-
ExploitTrigger OS command injection (CWE-78)
-
ExecutionExecute commands as service account
-
ImpactAccess scan data and pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Tenable Security Center web application (AV:N) and, per the published CVSS vector, low-level privileges (PR:L) - i.e., some valid account or session - even though the vendor description states 'unauthenticated'; this contradiction should be verified with Tenable before assuming pre-authentication exploitation is possible. No user interaction is required (UI:N) and no special attack conditions apply (AC:L/AT:N). The primary limiting factor is exposure of the management interface: if Security Center's web UI is confined to a restricted administrative network, remote reach is substantially reduced. The exact vulnerable feature/endpoint is not named in the provided data. |
| Impact | The signals point to a high-priority issue: network attack vector (AV:N), low complexity (AC:L), no attack requirements (AT:N), no user interaction (UI:N), and full high impact across all metrics, producing a 9.4 base score. The single mitigating factor in the vector is PR:L, indicating some authentication is required - which directly contradicts the description's 'unauthenticated' wording and must be resolved with the vendor before deciding whether pre-auth exposure exists. Because Security Center is a high-value security appliance holding an organization's entire vulnerability inventory, compromise is especially damaging, so even a mid-sized municipal IT team in leszno should treat this as urgent and patch quickly. That said, EPSS is not provided, there is no KEV listing, and no public exploit has surfaced, so current real-world exploitation appears speculative rather than confirmed - the priority derives from severity and asset criticality, not from observed attacks. |
| Exploit ScenarioDerived | An attacker who can reach the Security Center web interface submits a crafted request containing shell metacharacters in a parameter that is passed to an OS command, causing the appliance to execute attacker-chosen commands as the service account. From that foothold the attacker can read stored scan data and credentials, pivot into the environment, or establish persistence. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 14, 2026
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-system commands as the service account, yielding full control of the vulnerability-management console. Rated CVSS 9.4 (CVSS 4.0) with high confidentiality, integrity, and availability impact extending to the underlying host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; note the vendor description says 'unauthenticated' while the published CVSS vector carries PR:L, an unresolved discrepancy affecting who can actually trigger it.
RemediationAI
Apply the fix described in Tenable advisory tns-2026-22 (https://www.tenable.com/security/tns-2026-22); the provided data does not contain an exact fixed version number, so treat patch status as 'patch available per vendor advisory' and confirm the specific patched build from that page rather than assuming a version. As compensating controls until patched, restrict network access to the Security Center web interface to a trusted management VLAN or bastion via firewall/ACL so the network vector cannot be reached by general users (trade-off: legitimate admins must connect through the allowed path), place the console behind a reverse proxy or WAF tuned to block shell metacharacters in request parameters (trade-off: may cause false positives on scan-related fields), and monitor the appliance host for unexpected child processes spawned by the service account as a detection backstop. Rotate the service-account credentials and review appliance logs for signs of command execution after patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tenable Security Center is an on-premises enterprise vulnerability-management platform that aggregates Nessus scan data behind a web application running on Linux. The flaw is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-controllable input reaches a shell or system-call invocation without adequate sanitization, allowing injected shell metacharacters to be executed. Because the injected commands run with the privileges of the application's service account, an attacker gains code execution on the appliance host itself rather than only within the web tier - consistent with the CVSS 4.0 subsequent-system impact metrics (SC:H/SI:H/SA:H). Exact affected versions are not enumerated in the provided data; no CPE strings were supplied, so version scoping must come from vendor advisory tns-2026-22.
Know when Security Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable command injection with low complexity; PR:L follows the vendor vector despite the 'unauthenticated' text, and S:C reflects OS-level impact beyond the application, with full C/I/A loss.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
2DescriptionCVE.org
A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.
Executive ViewAI
Tenable Security Center contains a CRITICAL command injection flaw (CVE-2026-19682, CVSS 9.4) allowing remote attackers to execute arbitrary system commands and gain complete control of the vulnerability-management platform and underlying host. With no vendor patch available, the organization faces unremediable risk to core security infrastructure until Tenable releases a fix. Leadership must immediately implement network segmentation and prepare contingency plans for potential compromise of all vulnerability assessment operations.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Network segmentation and access control lists restricting console access to privileged management networks only; (2) Web Application Firewall rules targeting command injection signatures; (3) Enhanced operating-system monitoring and alerting for unauthorized process execution; (4) Service account credential rotation and strength verification; (5) Regular forensic review of authentication and audit logs for indicators of compromise. These controls reduce but do not eliminate the attack surface.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Security Center
View allAuthenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating sy
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrati
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell comm
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-a
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacke
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command exec
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file uplo
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their a
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access
Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were
Exploit-DB