Vulnerability · Published Aug 14, 2026 · Assigned by tenable

CVE-2026-19626Remote Code Execution

Critical 9.9

In plain English

A critical-severity security flaw in Security Center from Tenable, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code.

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)1.7%top 22.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Metasploit, Public PoC

Official description

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.

Affected products (as reported)

Vendor	Product	Versions
Tenable, Inc.	Security Center	0 – before 6.9.0

Weakness: CWE-95 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://www.tenable.com/security/tns-2026-22 vendor-advisory