CVE-2026-19681CWE-78command-injection

CVE-2026-19681

Critical · published August 14, 2026

CVSS v3.1
9.9
EPSS
10%
Percentile
95.6
In the wild
Unconfirmed
What it is

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.09936 · 95.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-14T22:17Z
Affected products (1)
ProductVersionsFixed in
tenable/security_center< 6.9.06.9.0
References (1)
https://www.tenable.com/security/tns-2026-22 · [email protected]
EPSS history
Timeline
  • 14 AUG 17:45Z
    Command Injection
    cvelistv5