CVE-2026-64879

Command Injection

State: Published
Severity: 9.4 Critical
Published: Jul 21, 2026
Updated: Jul 24, 2026
Reserved: Jul 20, 2026

Description

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	tenable
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	tenable

Weaknesses

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Affected Products

Product	Versions
Security CenterTenable, Inc.	before 6.8.0Not affectedfrom Patch SC202607.1Not affected

References

https://www.tenable.com/security/tns-2026-19

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.