CVE-2026-64879CWE-78command-injection

CVE-2026-64879

Critical · published July 22, 2026

CVSS v3.1
9.9
EPSS
2%
Percentile
82.9
In the wild
Unconfirmed
What it is

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02261 · 82.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-22T00:17Z
Affected products (1)
ProductVersionsFixed in
tenable/security_center≥ 6.6.0, ≤ 6.8.0—
References (1)
https://www.tenable.com/security/tns-2026-19 · [email protected]
EPSS history
Timeline
  • 21 JUL 19:54Z
    Command Injection
    cvelistv5