Tenable Inc
Monthly
Authenticated SQL injection in Tenable Nessus lets any user with a valid low-privilege Nessus account read or modify data stored by the scanner through the web interface or API, affecting every instance running a version below 10.12.5. The flaw is rated CVSS v4.0 8.7 and maps to CWE-89; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Tenable has shipped a vendor patch in Nessus 10.12.5, and the issue is best treated as a credible, elevated-priority finding rather than an emergency, because exploitation requires pre-existing credentials plus network reachability to the Nessus interface.
Command injection in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) lets an authenticated, low-privileged user execute arbitrary operating-system commands as SYSTEM on the primary domain controller emulator (PDCe). Both the vendor CVSS 4.0 vector (9.4) and our independent CVSS 3.1 assessment agree on PR:L with UI:N and changed scope, meaning an attacker who already holds a valid low-privileged tenant account needs no user interaction and faces low attack complexity to pivot from tenant access to domain-controller-level code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact is severe and the barrier of entry is only an existing credential, so this should be treated as a high-priority remediation.
SQL injection in Tenable Security Center exposes unauthorized database records to authenticated low-privilege users over the network. The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N vector confirms straightforward network exploitation with high confidentiality impact and limited integrity exposure. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has published advisory TNS-2026-22.
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacker to execute arbitrary OS commands on the underlying server. The root cause is insufficient sanitization of user-supplied filenames before they are passed to a downstream shell-invocable operation, classified under CWE-78. With a CVSS base score of 8.8 and full confidentiality, integrity, and availability impact, this represents a serious privilege escalation path within a product that itself manages vulnerability data across enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access to a specific configuration file to achieve arbitrary code execution at elevated privilege levels, with no user interaction required after file modification. Self-disclosed by Tenable and remediated in Security Center 6.9.0, as documented in advisory TNS-2026-22. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their authorized group scope, bypassing the platform's intended group-based access controls. The flaw affects all Security Center versions prior to 6.9.0 and is exploitable over the network by any user holding the Security Manager role with at least one 'manage user' permission grant. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the vendor has self-reported it and released a patch via advisory TNS-2026-22.
Remote code execution in Tenable Sensor Proxy (versions before 1.4.2) lets an attacker run code with elevated privileges by luring an operator into connecting the sensor to an attacker-controlled host. The CWE-94 code-injection flaw is triggered during that connection, and the CVSS 4.0 score of 9.3 reflects full compromise of confidentiality, integrity, and availability on the proxy host. There is no public exploit identified at time of analysis and it is not on CISA KEV, but a vendor patch is available.
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file upload handler, which fails to sanitize filenames and lets shell metacharacters reach a system command call. Rated CVSS 4.0 8.7 (High), the flaw is described as reaching full command execution when chained with a related vulnerability, giving an attacker code execution on the appliance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Blind SQL injection in Tenable Security Center (formerly Tenable.sc/SecurityCenter) lets an authenticated, low-privileged user manipulate report filtering parameters to read unauthorized data from the backend database. Because the vulnerable manager aggregates vulnerability, asset, and scan data across the enterprise, a successful attacker can exfiltrate sensitive security posture information belonging to other users and organizations. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was self-reported by Tenable under advisory TNS-2026-19.
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell commands by uploading an audit file whose filename contains shell metacharacters, which the application passes unsanitized into a system command. The flaw (CWE-78) carries a CVSS 4.0 base score of 9.4 with high impact to confidentiality, integrity, and availability of both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through asset filter parameters on the Analysis REST endpoint, breaking out of command argument handling to run arbitrary commands as a low-privileged OS user. The CVSS 4.0 base score of 9.4 reflects high confidentiality, integrity, and availability impact plus a scope change to subsequent systems, though exploitation requires low-level authenticated access (PR:L). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-admin user to read sensitive information from the underlying appliance database. Because any low-privileged authenticated account can trigger it over the network, the flaw effectively collapses the product's internal privilege boundaries and exposes vulnerability, asset, and configuration data held by the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Tenable) has released a fixed version.
Local privilege escalation in Tenable Nessus (≤10.11.3) and Nessus Agent (≤11.1.2) on Windows lets a low-privileged user abuse an NTFS junction to force the SYSTEM-level Nessus service into deleting arbitrary files, which can be leveraged for code execution as SYSTEM. Publicly available exploit code exists, but there is no evidence of active exploitation and the EPSS probability is negligible (0.01%, 3rd percentile). SSVC rates technical impact as total but exploitation as none and non-automatable, making this a credible but not urgent operator-side EoP.
Authenticated Nessus users who hold scan-creation rights can read arbitrary text files on a Linux scanner host at the privilege level of the nessusd service by running a custom Unix compliance audit policy against the scanner itself. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N): confidentiality-only, no write or denial-of-service impact, and reachable only by an account that already holds a valid, low-privileged-but-scan-capable role, making it primarily an insider or compromised-operator risk rather than an unauthenticated remote one. It is tracked at this_month priority - a genuine but moderate issue, not a drop-everything emergency - and no public exploit code was identified at time of analysis; no KEV listing applies.
Improper access control in Tenable Security Center enables authenticated non-administrative users to read application settings that fall outside their assigned organizational or role-based scope, constituting an unauthorized information disclosure. The vulnerability requires only a low-privileged authenticated account and is exploitable over a network with no user interaction or special triggering conditions, per the CVSS 4.0 vector (AV:N/AC:L/PR:L). No public exploit code has been identified and Tenable has published advisory TNS-2026-22; the CVSS 4.0 score of 5.3 (Medium) reflects the limited, read-only nature of the exposure.
Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22.
SQL injection in Tenable Security Center permits an authenticated administrator to execute arbitrary SQL queries against the underlying database, exposing sensitive data including stored credentials. The CVSS vector (PR:H) confirms exploitation requires existing administrator-level access, placing this squarely in the insider threat and compromised-admin scenario space. No public exploit code or active exploitation has been identified at time of analysis, but the 'Authentication Bypass' tag signals that extracted credentials could enable downstream privilege escalation or lateral movement into connected systems managed by Security Center.
Tenable OT contains an SSH misconfiguration that permits unauthorized disclosure of socket, port, and service information through the ostunnel user account and improper GatewayPorts settings. This vulnerability affects Tenable Operation Technology across multiple versions and allows attackers to enumerate underlying system architecture and network configuration without requiring high privileges or complex exploitation. While no CVSS score, EPSS data, or confirmed active exploitation is publicly documented, the information disclosure nature of this vulnerability enables reconnaissance for subsequent targeted attacks.
Authenticated SQL injection in Tenable Nessus lets any user with a valid low-privilege Nessus account read or modify data stored by the scanner through the web interface or API, affecting every instance running a version below 10.12.5. The flaw is rated CVSS v4.0 8.7 and maps to CWE-89; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Tenable has shipped a vendor patch in Nessus 10.12.5, and the issue is best treated as a credible, elevated-priority finding rather than an emergency, because exploitation requires pre-existing credentials plus network reachability to the Nessus interface.
Command injection in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) lets an authenticated, low-privileged user execute arbitrary operating-system commands as SYSTEM on the primary domain controller emulator (PDCe). Both the vendor CVSS 4.0 vector (9.4) and our independent CVSS 3.1 assessment agree on PR:L with UI:N and changed scope, meaning an attacker who already holds a valid low-privileged tenant account needs no user interaction and faces low attack complexity to pivot from tenant access to domain-controller-level code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact is severe and the barrier of entry is only an existing credential, so this should be treated as a high-priority remediation.
SQL injection in Tenable Security Center exposes unauthorized database records to authenticated low-privilege users over the network. The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N vector confirms straightforward network exploitation with high confidentiality impact and limited integrity exposure. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has published advisory TNS-2026-22.
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacker to execute arbitrary OS commands on the underlying server. The root cause is insufficient sanitization of user-supplied filenames before they are passed to a downstream shell-invocable operation, classified under CWE-78. With a CVSS base score of 8.8 and full confidentiality, integrity, and availability impact, this represents a serious privilege escalation path within a product that itself manages vulnerability data across enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access to a specific configuration file to achieve arbitrary code execution at elevated privilege levels, with no user interaction required after file modification. Self-disclosed by Tenable and remediated in Security Center 6.9.0, as documented in advisory TNS-2026-22. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their authorized group scope, bypassing the platform's intended group-based access controls. The flaw affects all Security Center versions prior to 6.9.0 and is exploitable over the network by any user holding the Security Manager role with at least one 'manage user' permission grant. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the vendor has self-reported it and released a patch via advisory TNS-2026-22.
Remote code execution in Tenable Sensor Proxy (versions before 1.4.2) lets an attacker run code with elevated privileges by luring an operator into connecting the sensor to an attacker-controlled host. The CWE-94 code-injection flaw is triggered during that connection, and the CVSS 4.0 score of 9.3 reflects full compromise of confidentiality, integrity, and availability on the proxy host. There is no public exploit identified at time of analysis and it is not on CISA KEV, but a vendor patch is available.
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file upload handler, which fails to sanitize filenames and lets shell metacharacters reach a system command call. Rated CVSS 4.0 8.7 (High), the flaw is described as reaching full command execution when chained with a related vulnerability, giving an attacker code execution on the appliance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Blind SQL injection in Tenable Security Center (formerly Tenable.sc/SecurityCenter) lets an authenticated, low-privileged user manipulate report filtering parameters to read unauthorized data from the backend database. Because the vulnerable manager aggregates vulnerability, asset, and scan data across the enterprise, a successful attacker can exfiltrate sensitive security posture information belonging to other users and organizations. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was self-reported by Tenable under advisory TNS-2026-19.
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell commands by uploading an audit file whose filename contains shell metacharacters, which the application passes unsanitized into a system command. The flaw (CWE-78) carries a CVSS 4.0 base score of 9.4 with high impact to confidentiality, integrity, and availability of both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through asset filter parameters on the Analysis REST endpoint, breaking out of command argument handling to run arbitrary commands as a low-privileged OS user. The CVSS 4.0 base score of 9.4 reflects high confidentiality, integrity, and availability impact plus a scope change to subsequent systems, though exploitation requires low-level authenticated access (PR:L). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-admin user to read sensitive information from the underlying appliance database. Because any low-privileged authenticated account can trigger it over the network, the flaw effectively collapses the product's internal privilege boundaries and exposes vulnerability, asset, and configuration data held by the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Tenable) has released a fixed version.
Local privilege escalation in Tenable Nessus (≤10.11.3) and Nessus Agent (≤11.1.2) on Windows lets a low-privileged user abuse an NTFS junction to force the SYSTEM-level Nessus service into deleting arbitrary files, which can be leveraged for code execution as SYSTEM. Publicly available exploit code exists, but there is no evidence of active exploitation and the EPSS probability is negligible (0.01%, 3rd percentile). SSVC rates technical impact as total but exploitation as none and non-automatable, making this a credible but not urgent operator-side EoP.
Authenticated Nessus users who hold scan-creation rights can read arbitrary text files on a Linux scanner host at the privilege level of the nessusd service by running a custom Unix compliance audit policy against the scanner itself. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N): confidentiality-only, no write or denial-of-service impact, and reachable only by an account that already holds a valid, low-privileged-but-scan-capable role, making it primarily an insider or compromised-operator risk rather than an unauthenticated remote one. It is tracked at this_month priority - a genuine but moderate issue, not a drop-everything emergency - and no public exploit code was identified at time of analysis; no KEV listing applies.
Improper access control in Tenable Security Center enables authenticated non-administrative users to read application settings that fall outside their assigned organizational or role-based scope, constituting an unauthorized information disclosure. The vulnerability requires only a low-privileged authenticated account and is exploitable over a network with no user interaction or special triggering conditions, per the CVSS 4.0 vector (AV:N/AC:L/PR:L). No public exploit code has been identified and Tenable has published advisory TNS-2026-22; the CVSS 4.0 score of 5.3 (Medium) reflects the limited, read-only nature of the exposure.
Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22.
SQL injection in Tenable Security Center permits an authenticated administrator to execute arbitrary SQL queries against the underlying database, exposing sensitive data including stored credentials. The CVSS vector (PR:H) confirms exploitation requires existing administrator-level access, placing this squarely in the insider threat and compromised-admin scenario space. No public exploit code or active exploitation has been identified at time of analysis, but the 'Authentication Bypass' tag signals that extracted credentials could enable downstream privilege escalation or lateral movement into connected systems managed by Security Center.
Tenable OT contains an SSH misconfiguration that permits unauthorized disclosure of socket, port, and service information through the ostunnel user account and improper GatewayPorts settings. This vulnerability affects Tenable Operation Technology across multiple versions and allows attackers to enumerate underlying system architecture and network configuration without requiring high privileges or complex exploitation. While no CVSS score, EPSS data, or confirmed active exploitation is publicly documented, the information disclosure nature of this vulnerability enables reconnaissance for subsequent targeted attacks.