CVE-2026-19628
Remote Code Execution
- State
- Published
- Severity
- 8.6 High
- Published
- Aug 14, 2026
- Updated
- Aug 15, 2026
- Reserved
- Aug 12, 2026
Description
A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | tenable |
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | tenable |
Weaknesses
- CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')
Affected Products
| Product | Versions |
|---|---|
Security CenterTenable, Inc. |
|
References
- https://www.tenable.com/security/tns-2026-22vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.