Description
An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.
Published: 2026-08-14
Score: 8.7 High
EPSS: 1.1% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An input validation flaw in Tenable Security Center’s file upload handling allows an attacker to supply a malicious file name that is not properly sanitized, potentially leading to shell command execution on the host. The vulnerability is identified as an operating‑system command injection (CWE‑78). If exploited, arbitrary commands can run with the privileges of the application, enabling full compromise of the impacted systems.

Affected Systems

Tenable Inc. Security Center versions released before 6.9.0 are affected. The flaw is located in the component that processes file uploads and does not appear in later releases.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, signifying high severity. EPSS score of 1.56% and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, accessed through the web‑based file upload interface, and an adversary with upload access could craft a filename that triggers unintended command execution, thereby breaking confidentiality, integrity, and availability.

Generated by OpenCVE AI on August 15, 2026 at 21:38 UTC.

Remediation

Vendor Solution

Tenable has released Security Center 6.9.0 to address these issues. The installation files can be obtained from the Tenable Downloads Portal:  https://www.tenable.com/downloads/security-center

OpenCVE Recommended Actions

  • Install Security Center 6.9.0 from the Tenable Downloads Portal.
  • Disable or restrict the file upload feature until the upgrade is completed.
  • Monitor upload traffic for suspicious file names and anomalous command execution attempts.

Generated by OpenCVE AI on August 15, 2026 at 21:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:tenable:security_center:*:*:*:*:*:*:*:*

Fri, 14 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Tenable
Tenable security Center
Vendors & Products Tenable
Tenable security Center

Fri, 14 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 14 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.
Title Improper Input Validation
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Tenable Security Center
cve-icon MITRE

Status: PUBLISHED

Assigner: tenable

Published:

Updated: 2026-08-14T19:33:42.993Z

Reserved: 2026-08-12T22:42:06.733Z

Link: CVE-2026-19679

cve-icon Vulnrichment

Updated: 2026-08-14T19:33:36.703Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-14T18:17:23.230

Modified: 2026-08-19T17:10:07.050

Link: CVE-2026-19679

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T21:45:02Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')