The vulnerability arises because the system generated CSRF tokens using a predictable method, which reduces the effectiveness of this security control. An attacker who observes or deduces the token generation pattern could predict valid tokens and subsequently craft forged requests that the application would accept as legitimate. This could allow them to perform unauthorized state‑changing operations without requiring user interaction, effectively bypassing one of the primary safeguards against cross‑site request forgery. The impact is restricted to the confidentiality and integrity of actions that are normally protected by CSRF token validation, and it does not directly lead to arbitrary code execution or system compromise.

The affected product is Tenable Security Center. All versions released before the 6.9.0 update are vulnerable. Tenable has issued a fix in Security Center 6.9.0, which can be downloaded from the Tenable portal.

The CVSS score of 6 signifies a medium severity level, indicating a moderate risk to systems if not mitigated. The EPSS score is not available, so current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not known to have active, widespread exploitable attacks. The likely attack vector is remote, via the web interface, where an attacker could generate or guess CSRF tokens and submit malicious requests. Successful exploitation would allow unauthorized actions authenticated under the victim’s browser session.