CVE-2026-19626
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.
Risk Assessment
An authenticated user could gain full control of the server, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update Tenable Security Center to a patched version. Restrict user privileges and monitor report generation activity.
Other vulnerabilities in Tenable Security Center
See all- CVE-2026-19629High
A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized cross-group user management.
- CVE-2026-19628High
Tenable Security Center has a command injection vulnerability. An authenticated administrator can modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered.
Original NVD description (English source)
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS