The vulnerability originates from the audit file upload handler in Tenable Security Center, which fails to sanitize filenames. As a result, shell metacharacters can be injected into system command execution paths. This input validation failure enables a command injection attack, particularly when combined with a related vulnerability. The active weakness is a classic command injection flaw, identified as CWE‑78, and if exploited, an attacker could execute arbitrary operating‑system commands, potentially compromising confidentiality, integrity, and availability of the affected system.

Tenable, Inc. Security Center is impacted. Versions prior to the release of Patch SC202607.1 are affected; no specific affected build numbers are listed in the advisory, so all installations lacking the patch should be considered at risk.

The CVSS score of 8.7 places this issue in the High severity range, while the EPSS score of 1.44% indicates a modest but measurable probability of exploitation. Although the vulnerability is not listed in the CISA KEV catalog, it remains a serious threat. The likely attack vector is through the file upload interface; an authenticated or unauthenticated attacker with access to the audit upload feature could supply a malicious filename, potentially leading to remote code execution without additional privileges.