Read the docs
TI-2026-02246 Aliases CVE-2026-2630GHSA-frcr-mg6p-g499

OS command injection in Tenable Security Center

Priority LOW 37CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security Center is hosted.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01325 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TenableSecurity Centerup to 6.7.2—No fix listedCNA
  • Security Center VendorTenable Affected up to 6.7.2 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:tenable:security_center:*:*:*:*:*:*:*:*——Tenable
  • cpe:2.3:a:tenable:security_center:*:*:*:*:*:*:*:* Versions — — ·Tenable

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-2630
  2. 2026-10-03 Alias added: GHSA-frcr-mg6p-g499

References

Other 1

  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
  • TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2020-08897 Potential XSS vulnerability in jQuery KEVCVSS 3.1MEDIUM 6.9
  • TI-2021-20274 Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier CVSS 3.1CRITICAL 9.8
  • TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
See all 217 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences