Vulnerability · Published Jul 21, 2026 · Assigned by tenable
CVE-2026-64879Command Injection
Critical 9.9
In plain English
A critical-severity OS command injection in Security Center from Tenable, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities).
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)2.3%top 16.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Tenable, Inc. | Security Center | see references |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H