Security Center
Monthly
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-system commands as the service account, yielding full control of the vulnerability-management console. Rated CVSS 9.4 (CVSS 4.0) with high confidentiality, integrity, and availability impact extending to the underlying host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; note the vendor description says 'unauthenticated' while the published CVSS vector carries PR:L, an unresolved discrepancy affecting who can actually trigger it.
Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating system commands by uploading a specially crafted file that is unsafely handled during upload processing. The flaw was reported by Tenable's own research team (advisory tns-2026-22) and carries a CVSS 4.0 base score of 9.4 with high impact on both the vulnerable system and subsequent systems. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low privilege bar (PR:L) combined with full code-execution impact makes this a high-priority patch for internet-facing or shared consoles.
SQL injection in Tenable Security Center exposes unauthorized database records to authenticated low-privilege users over the network. The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N vector confirms straightforward network exploitation with high confidentiality impact and limited integrity exposure. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has published advisory TNS-2026-22.
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacker to execute arbitrary OS commands on the underlying server. The root cause is insufficient sanitization of user-supplied filenames before they are passed to a downstream shell-invocable operation, classified under CWE-78. With a CVSS base score of 8.8 and full confidentiality, integrity, and availability impact, this represents a serious privilege escalation path within a product that itself manages vulnerability data across enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper access control in Tenable Security Center enables authenticated non-administrative users to read application settings that fall outside their assigned organizational or role-based scope, constituting an unauthorized information disclosure. The vulnerability requires only a low-privileged authenticated account and is exploitable over a network with no user interaction or special triggering conditions, per the CVSS 4.0 vector (AV:N/AC:L/PR:L). No public exploit code has been identified and Tenable has published advisory TNS-2026-22; the CVSS 4.0 score of 5.3 (Medium) reflects the limited, read-only nature of the exposure.
Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22.
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command execution by embedding shell metacharacters in application configuration values, which are later executed unsanitized when specific backend operations are triggered. The CWE-78 root cause and the PR:H CVSS 4.0 metric confirm exploitation is gated behind administrator-level access, restricting the realistic attacker population to insiders, compromised admin credentials, or post-escalation actors. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Tenable self-reported this via vulnreport@tenable.com and published advisory TNS-2026-22.
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrative user to run arbitrary code with the privileges of the service account by submitting crafted input that is unsafely evaluated during server-side report rendering. Because Security Center is itself a centralized vulnerability-management platform holding scan data and credentials for an entire estate, compromise of the service account is high-impact. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access to a specific configuration file to achieve arbitrary code execution at elevated privilege levels, with no user interaction required after file modification. Self-disclosed by Tenable and remediated in Security Center 6.9.0, as documented in advisory TNS-2026-22. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
SQL injection in Tenable Security Center permits an authenticated administrator to execute arbitrary SQL queries against the underlying database, exposing sensitive data including stored credentials. The CVSS vector (PR:H) confirms exploitation requires existing administrator-level access, placing this squarely in the insider threat and compromised-admin scenario space. No public exploit code or active exploitation has been identified at time of analysis, but the 'Authentication Bypass' tag signals that extracted credentials could enable downstream privilege escalation or lateral movement into connected systems managed by Security Center.
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their authorized group scope, bypassing the platform's intended group-based access controls. The flaw affects all Security Center versions prior to 6.9.0 and is exploitable over the network by any user holding the Security Manager role with at least one 'manage user' permission grant. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the vendor has self-reported it and released a patch via advisory TNS-2026-22.
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file upload handler, which fails to sanitize filenames and lets shell metacharacters reach a system command call. Rated CVSS 4.0 8.7 (High), the flaw is described as reaching full command execution when chained with a related vulnerability, giving an attacker code execution on the appliance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Blind SQL injection in Tenable Security Center (formerly Tenable.sc/SecurityCenter) lets an authenticated, low-privileged user manipulate report filtering parameters to read unauthorized data from the backend database. Because the vulnerable manager aggregates vulnerability, asset, and scan data across the enterprise, a successful attacker can exfiltrate sensitive security posture information belonging to other users and organizations. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was self-reported by Tenable under advisory TNS-2026-19.
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell commands by uploading an audit file whose filename contains shell metacharacters, which the application passes unsanitized into a system command. The flaw (CWE-78) carries a CVSS 4.0 base score of 9.4 with high impact to confidentiality, integrity, and availability of both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through asset filter parameters on the Analysis REST endpoint, breaking out of command argument handling to run arbitrary commands as a low-privileged OS user. The CVSS 4.0 base score of 9.4 reflects high confidentiality, integrity, and availability impact plus a scope change to subsequent systems, though exploitation requires low-level authenticated access (PR:L). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-admin user to read sensitive information from the underlying appliance database. Because any low-privileged authenticated account can trigger it over the network, the flaw effectively collapses the product's internal privilege boundaries and exposes vulnerability, asset, and configuration data held by the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Tenable) has released a fixed version.
Security Center's access control implementation fails to properly restrict authenticated users to their authorized scope, allowing privilege escalation to view sensitive data. An attacker with valid credentials can bypass authorization checks to access confidential information outside their assigned permissions. No patch is currently available for this vulnerability.
Authenticated users of Security Center can manipulate the 'owner' parameter to gain unauthorized elevated privileges through an indirect object reference flaw. This network-accessible vulnerability requires valid credentials but no user interaction, enabling privilege escalation attacks with moderate impact on confidentiality, integrity, and availability. No patch is currently available.
An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Repository parameters, which could lead to. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack that allowed an attacker to elevate. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-system commands as the service account, yielding full control of the vulnerability-management console. Rated CVSS 9.4 (CVSS 4.0) with high confidentiality, integrity, and availability impact extending to the underlying host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; note the vendor description says 'unauthenticated' while the published CVSS vector carries PR:L, an unresolved discrepancy affecting who can actually trigger it.
Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating system commands by uploading a specially crafted file that is unsafely handled during upload processing. The flaw was reported by Tenable's own research team (advisory tns-2026-22) and carries a CVSS 4.0 base score of 9.4 with high impact on both the vulnerable system and subsequent systems. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low privilege bar (PR:L) combined with full code-execution impact makes this a high-priority patch for internet-facing or shared consoles.
SQL injection in Tenable Security Center exposes unauthorized database records to authenticated low-privilege users over the network. The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N vector confirms straightforward network exploitation with high confidentiality impact and limited integrity exposure. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has published advisory TNS-2026-22.
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacker to execute arbitrary OS commands on the underlying server. The root cause is insufficient sanitization of user-supplied filenames before they are passed to a downstream shell-invocable operation, classified under CWE-78. With a CVSS base score of 8.8 and full confidentiality, integrity, and availability impact, this represents a serious privilege escalation path within a product that itself manages vulnerability data across enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper access control in Tenable Security Center enables authenticated non-administrative users to read application settings that fall outside their assigned organizational or role-based scope, constituting an unauthorized information disclosure. The vulnerability requires only a low-privileged authenticated account and is exploitable over a network with no user interaction or special triggering conditions, per the CVSS 4.0 vector (AV:N/AC:L/PR:L). No public exploit code has been identified and Tenable has published advisory TNS-2026-22; the CVSS 4.0 score of 5.3 (Medium) reflects the limited, read-only nature of the exposure.
Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22.
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command execution by embedding shell metacharacters in application configuration values, which are later executed unsanitized when specific backend operations are triggered. The CWE-78 root cause and the PR:H CVSS 4.0 metric confirm exploitation is gated behind administrator-level access, restricting the realistic attacker population to insiders, compromised admin credentials, or post-escalation actors. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Tenable self-reported this via vulnreport@tenable.com and published advisory TNS-2026-22.
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrative user to run arbitrary code with the privileges of the service account by submitting crafted input that is unsafely evaluated during server-side report rendering. Because Security Center is itself a centralized vulnerability-management platform holding scan data and credentials for an entire estate, compromise of the service account is high-impact. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access to a specific configuration file to achieve arbitrary code execution at elevated privilege levels, with no user interaction required after file modification. Self-disclosed by Tenable and remediated in Security Center 6.9.0, as documented in advisory TNS-2026-22. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
SQL injection in Tenable Security Center permits an authenticated administrator to execute arbitrary SQL queries against the underlying database, exposing sensitive data including stored credentials. The CVSS vector (PR:H) confirms exploitation requires existing administrator-level access, placing this squarely in the insider threat and compromised-admin scenario space. No public exploit code or active exploitation has been identified at time of analysis, but the 'Authentication Bypass' tag signals that extracted credentials could enable downstream privilege escalation or lateral movement into connected systems managed by Security Center.
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their authorized group scope, bypassing the platform's intended group-based access controls. The flaw affects all Security Center versions prior to 6.9.0 and is exploitable over the network by any user holding the Security Manager role with at least one 'manage user' permission grant. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the vendor has self-reported it and released a patch via advisory TNS-2026-22.
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file upload handler, which fails to sanitize filenames and lets shell metacharacters reach a system command call. Rated CVSS 4.0 8.7 (High), the flaw is described as reaching full command execution when chained with a related vulnerability, giving an attacker code execution on the appliance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Blind SQL injection in Tenable Security Center (formerly Tenable.sc/SecurityCenter) lets an authenticated, low-privileged user manipulate report filtering parameters to read unauthorized data from the backend database. Because the vulnerable manager aggregates vulnerability, asset, and scan data across the enterprise, a successful attacker can exfiltrate sensitive security posture information belonging to other users and organizations. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was self-reported by Tenable under advisory TNS-2026-19.
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell commands by uploading an audit file whose filename contains shell metacharacters, which the application passes unsanitized into a system command. The flaw (CWE-78) carries a CVSS 4.0 base score of 9.4 with high impact to confidentiality, integrity, and availability of both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through asset filter parameters on the Analysis REST endpoint, breaking out of command argument handling to run arbitrary commands as a low-privileged OS user. The CVSS 4.0 base score of 9.4 reflects high confidentiality, integrity, and availability impact plus a scope change to subsequent systems, though exploitation requires low-level authenticated access (PR:L). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-admin user to read sensitive information from the underlying appliance database. Because any low-privileged authenticated account can trigger it over the network, the flaw effectively collapses the product's internal privilege boundaries and exposes vulnerability, asset, and configuration data held by the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Tenable) has released a fixed version.
Security Center's access control implementation fails to properly restrict authenticated users to their authorized scope, allowing privilege escalation to view sensitive data. An attacker with valid credentials can bypass authorization checks to access confidential information outside their assigned permissions. No patch is currently available for this vulnerability.
Authenticated users of Security Center can manipulate the 'owner' parameter to gain unauthorized elevated privileges through an indirect object reference flaw. This network-accessible vulnerability requires valid credentials but no user interaction, enabling privilege escalation attacks with moderate impact on confidentiality, integrity, and availability. No patch is currently available.
An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Repository parameters, which could lead to. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL Injection in the Hardware Inventory report of Security Center 5.11.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack that allowed an attacker to elevate. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.