EUVD-2026-58748
GHSA-p62v-hxp2-pv79
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable command injection with low complexity; PR:L follows the vendor vector despite the 'unauthenticated' text, and S:C reflects OS-level impact beyond the application, with full C/I/A loss.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.
AnalysisAI
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-system commands as the service account, yielding full control of the vulnerability-management console. Rated CVSS 9.4 (CVSS 4.0) with high confidentiality, integrity, and availability impact extending to the underlying host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Tenable Security Center web application (AV:N) and, per the published CVSS vector, low-level privileges (PR:L) - i.e., some valid account or session - even though the vendor description states 'unauthenticated'; this contradiction should be verified with Tenable before assuming pre-authentication exploitation is possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a high-priority issue: network attack vector (AV:N), low complexity (AC:L), no attack requirements (AT:N), no user interaction (UI:N), and full high impact across all metrics, producing a 9.4 base score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Security Center web interface submits a crafted request containing shell metacharacters in a parameter that is passed to an OS command, causing the appliance to execute attacker-chosen commands as the service account. From that foothold the attacker can read stored scan data and credentials, pivot into the environment, or establish persistence. … |
| Remediation | Apply the fix described in Tenable advisory tns-2026-22 (https://www.tenable.com/security/tns-2026-22); the provided data does not contain an exact fixed version number, so treat patch status as 'patch available per vendor advisory' and confirm the specific patched build from that page rather than assuming a version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, isolate Tenable Security Center instances from untrusted network segments, confirm the installed version from the administrative console, and preserve authentication and process-execution logs for forensic review. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Center
View allOS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell comm
Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating sy
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrati
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-a
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacke
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command exec
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file uplo
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerabi
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their a
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access
Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today