CVE-2026-2630

[R1] Stand-alone Security Patches Available for Tenable Security Center versions 6.5.1, 6.6.0 and 6.7.2: SC-202602.1 + SC-202602.2

State: Published
Severity: 7.4 High
Published: Feb 17, 2026
Updated: Feb 26, 2026
Reserved: Feb 17, 2026

Read the record on cve.org

Description

A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security Center is hosted.

Scores

CVSS	Score	Vector	Source
4.0	7.4 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	tenable
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	tenable

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Security CenterTenable	6.7.2 and earlierAffectedfrom SC-202602.2Not affected

References

https://www.tenable.com/security/tns-2026-06

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.