CVE-2026-19628
HighCVSS 7.2Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
Tenable Security Center has a command injection vulnerability. An authenticated administrator can modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered.
Risk Assessment
A person with administrator privileges can gain full control over the operating system, potentially leading to complete environment compromise.
Recommendation
It is recommended to restrict access to administrator accounts and monitor configuration changes. Also check for vendor updates.
Other vulnerabilities in Tenable Security Center
See all- CVE-2026-19626Critical
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.
- CVE-2026-19629High
A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized cross-group user management.
- CVE-2025-36636Medium
In Tenable Security Center versions prior to 6.7.0, an improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.
Original NVD description (English source)
A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS