Four critical flaws in Tenable Security Center: CVE-2026-64878 et al. — post-login takeover, update to 6.8.0

Tenable Security Center (formerly Tenable.sc), a vulnerability-management product used by enterprise security teams, has five serious flaws. CVE-2026-64878 and CVE-2026-64879 (both rated 9.9) let a logged-in user run arbitrary commands on the server that runs the product (takeover), while CVE-2026-64877 (8.4) lets even a low-privileged user pull sensitive data from the internal database. CVE-2026-64881 (8.8) is a further command-injection flaw that reaches execution when chained, and the same advisory also includes CVE-2026-64880. Exploitation requires a login — this is not a no-auth, mass-scan case — but a vulnerability-management product being taken over is no small matter.

Tenable disclosed these in its security advisory TNS-2026-19 (first published 2026-07-20, revised through 2026-07-23) and released the fix, Security Center 6.8.0. For the 6.x line it also offers a standalone patch, SC202607.1. Affected are Linux builds 6.6.0 through 6.8.0 (fixed in 6.8.0). The advisory also bundles updates to third-party components (Apache, OpenSSL, PostgreSQL, PHP, Redis, and others). Tenable Security Center is the "command center" that inventories the weaknesses of an organization's systems, so a takeover there spreads. Below we walk through what happens and how to respond.

Who targets this, and why

The people who can exploit these four are those who can log into Tenable Security Center with a valid account. They don't need to be an administrator; a low-privileged regular user is enough. That means a malicious insider, a contractor, an attacker who phished a user's login, or one who obtained a single valid account another way. It isn't a no-login, mass-from-outside case — but "get one valid account and reach takeover" is not something to dismiss.

The attacker slips "shell metacharacters" (special symbols) into weakly checked spots — such as an analysis filter or an audit-file upload — and runs arbitrary commands on the server that runs the product. Using SQL injection (planting a malicious string into database commands) they can also read sensitive data from the internal database. The endpoints lead to takeover of the server and theft of the stored data.

The weight of the damage comes from what the product is. Tenable Security Center aggregates the vulnerability and asset information of an organization's servers and network gear — a "command center" for defense. A takeover hands the attacker a map of where every weakness lives, ready-made reconnaissance for the next attack. Its broad reach (scan access to many devices) can also be a springboard deeper into the network. That is why the update or patch below should be done promptly.

The five flaws in detail

CVE-2026-64878 (CVSS 9.9): commands run from an analysis filter

In the analysis REST API (an interface where programs talk to each other), the value passed to an asset filter was not checked thoroughly. Slipping shell metacharacters in there runs commands on the server that runs the product. This is an OS command injection flaw; execution happens as a low-privileged OS user, but it leads to server compromise and data theft. Exploitation requires a login.

CVE-2026-64879 (CVSS 9.9): commands run from an audit-file upload

In the audit-file upload feature, filenames were not checked thoroughly. Planting shell metacharacters in a filename gets it run as a command. Like CVE-2026-64878, it is OS command injection and carries the same 9.9 severity. The abuse of a legitimate upload action is the awkward part; it too requires a login.

CVE-2026-64877 (CVSS 8.4): pulling internal data from the ticketing feature

The ticketing REST API had a SQL injection flaw. Even a low-privileged (non-admin) user can read sensitive data stored in the internal database. Where the other two reach server takeover (command execution), this one is mainly about data theft — but the data Security Center holds is the organization's own weakness inventory, so a leak feeds an attacker's reconnaissance directly.

CVE-2026-64881 (CVSS 8.8): a chained command injection from an audit filename

Like CVE-2026-64879, this is a flaw where the audit-file upload doesn't check filenames thoroughly. Shell metacharacters planted in a filename flow into system command execution. Because it doesn't stand alone and must be chained with another vulnerability, it is rated 8.8 — but the fix is the same as the other three: update to 6.8.0 or apply patch SC202607.1.

CVE-2026-64880 (severity 7.1): another database data leak

Tenable's advisory TNS-2026-19 lists CVE-2026-64880 alongside the four above. It is a "blind SQL injection": the attacker infers the contents of the internal database one piece at a time by watching how the screen responds (success or failure, timing of the reply) to injected queries. It is rated 7.1 (High) and needs a login plus some operating privileges. Like CVE-2026-64877, it leads to database data disclosure, and the remedy is the same as the other four: update to Security Center 6.8.0 or apply the standalone patch SC202607.1. See TNS-2026-19 and the NVD entry for full details.

Affected scope (version quick reference)

Whether you're affected comes down to your Security Center version and host OS. All five affect Linux builds 6.6.0 through 6.8.0 (fixed in 6.8.0).

If you can't jump to 6.8.0 right away, the standalone patch SC202607.1 for the 6.x line addresses all five. The more broadly the login screen is reachable (from the internet or a wide internal network), the higher the risk of a stolen account being abused — so prioritize those instances.

What to do right now

The fix is to update Tenable Security Center to 6.8.0 or later, or apply the standalone patch SC202607.1 for the 6.x line. The details are consolidated in Tenable's advisory TNS-2026-19. All five require a login, so they aren't a no-auth mass-scan case — but since two are 9.9 command-execution flaws, closing them together is the sure move.

If you can't update immediately, useful stopgaps are to audit Security Center user accounts and remove unneeded ones, enforce multi-factor authentication, and restrict how the login screen (management console) can be reached to a limited internal range. Since abuse hinges on a valid login, limiting who can log in and from where curbs the damage.

As of publication, primary sources show no report of these five being used in real attacks, no public proof-of-concept, and no listing on the U.S. CISA catalog of actively exploited vulnerabilities (KEV). Even so, a vulnerability-management product is a chokepoint where an organization's weakness data collects — a high-value target. You can check how far attacks are spreading in our tracker of actively exploited vulnerabilities (Japanese).

FAQ

Summary

Tenable Security Center, a vulnerability-management product, has five serious flaws. CVE-2026-64878 and CVE-2026-64879 (both 9.9) are OS command injections that reach server takeover after login; CVE-2026-64877 (8.4) is a SQL injection that lets even a low-privileged user pull sensitive data from the internal database; CVE-2026-64881 (8.8) is a further command injection that requires chaining. The same advisory, TNS-2026-19, also includes CVE-2026-64880 (7.1, a blind SQL injection). Exploitation needs a login, so it isn't a no-auth mass-scan case — but "one valid account and you reach takeover" is not to be dismissed.

The fix is to update to Security Center 6.8.0 or apply the standalone patch SC202607.1 for the 6.x line. Also audit user accounts, enforce MFA, and restrict console reachability. Security Center is the "command center" where weakness data collects, so a takeover spreads widely. Since leaving even one open can lead to server takeover, don't put the update off.

Sources

• ▸ NVD - CVE-2026-64878 (OS command injection in the analysis API)
• ▸ NVD - CVE-2026-64879 (OS command injection in audit-file upload)
• ▸ NVD - CVE-2026-64877 (SQL injection in the ticketing API)
• ▸ NVD - CVE-2026-64881 (OS command injection in audit-file upload, needs chaining)
• ▸ NVD - CVE-2026-64880 (included in the same advisory; details being confirmed)
• ▸ Tenable - Advisory TNS-2026-19 (fix 6.8.0 / patch SC202607.1)
• ▸ Tenable - Nessus plugin 328966 (detects TNS-2026-19)
• ▸ Tenable Security Center product page
• ▸ Related: tracker of actively exploited vulnerabilities, CISA KEV (Japanese, this site)