Four critical flaws in Tenable Security Center: CVE-2026-64878 et al. — post-login takeover, update to 6.8.0

Tenable Security Center (formerly Tenable.sc), a vulnerability-management product used by enterprise security teams, has four serious flaws. CVE-2026-64878 and CVE-2026-64879 (both rated 9.9) let a logged-in user run arbitrary commands on the server that runs the product (takeover), while CVE-2026-64877 (9.6) lets even a low-privileged user pull sensitive data from the internal database. Exploitation requires a login — this is not a no-auth, mass-scan case — but a vulnerability-management product being taken over is no small matter.

Tenable has released the fix, Security Center 6.8.0, and also offers a standalone patch SC202607.1 for the 6.x line. Affected are versions before 6.8.0 running on Linux. Tenable Security Center is the "command center" that inventories the weaknesses of an organization's systems, so a takeover there spreads. Below we walk through what happens and how to respond.

Who targets this, and why

The people who can exploit these four are those who can log into Tenable Security Center with a valid account. They don't need to be an administrator; a low-privileged regular user is enough. That means a malicious insider, a contractor, an attacker who phished a user's login, or one who obtained a single valid account another way. It isn't a no-login, mass-from-outside case — but "get one valid account and reach takeover" is not something to dismiss.

The attacker slips "shell metacharacters" (special symbols) into weakly checked spots — such as an analysis filter or an audit-file upload — and runs arbitrary commands on the server that runs the product. Using SQL injection (planting a malicious string into database commands) they can also read sensitive data from the internal database. The endpoints lead to takeover of the server and theft of the stored data.

The weight of the damage comes from what the product is. Tenable Security Center aggregates the vulnerability and asset information of an organization's servers and network gear — a "command center" for defense. A takeover hands the attacker a map of where every weakness lives, ready-made reconnaissance for the next attack. Its broad reach (scan access to many devices) can also be a springboard deeper into the network. That is why the update or patch below should be done promptly.

The four flaws in detail

CVE-2026-64878 (CVSS 9.9): commands run from an analysis filter

In the analysis REST API (an interface where programs talk to each other), the value passed to an asset filter was not checked thoroughly. Slipping shell metacharacters in there runs commands on the server that runs the product. This is an OS command injection flaw; execution happens as a low-privileged OS user, but it leads to server compromise and data theft. Exploitation requires a login.

CVE-2026-64879 (CVSS 9.9): commands run from an audit-file upload

In the audit-file upload feature, filenames were not checked thoroughly. Planting shell metacharacters in a filename gets it run as a command. Like CVE-2026-64878, it is OS command injection and carries the same 9.9 severity. The abuse of a legitimate upload action is the awkward part; it too requires a login.

CVE-2026-64877 (CVSS 9.6): pulling internal data from the ticketing feature

The ticketing REST API had a SQL injection flaw. Even a low-privileged (non-admin) user can read sensitive data stored in the internal database. Where the other two reach server takeover (command execution), this one is mainly about data theft — but the data Security Center holds is the organization's own weakness inventory, so a leak feeds an attacker's reconnaissance directly.

CVE-2026-64881 (CVSS 8.8): a chained command injection from an audit filename

Like CVE-2026-64879, this is a flaw where the audit-file upload doesn't check filenames thoroughly. Shell metacharacters planted in a filename flow into system command execution. Because it doesn't stand alone and must be chained with another vulnerability, it is rated 8.8 — but the fix is the same as the other three: update to 6.8.0 or apply patch SC202607.1.

Affected scope (version quick reference)

Whether you're affected comes down to your Security Center version and host OS. All four affect Linux builds before 6.8.0.

If you can't jump to 6.8.0 right away, the standalone patch SC202607.1 for the 6.x line addresses all four. The more broadly the login screen is reachable (from the internet or a wide internal network), the higher the risk of a stolen account being abused — so prioritize those instances.

What to do right now

The fix is to update Tenable Security Center to 6.8.0 or later, or apply the standalone patch SC202607.1 for the 6.x line. The latest fixes, patches, and release details are on Tenable's security advisories. All four require a login, so they aren't a no-auth mass-scan case — but since two are 9.9 command-execution flaws, closing them together is the sure move.

If you can't update immediately, useful stopgaps are to audit Security Center user accounts and remove unneeded ones, enforce multi-factor authentication, and restrict how the login screen (management console) can be reached to a limited internal range. Since abuse hinges on a valid login, limiting who can log in and from where curbs the damage.

As of publication, there is no report of these four being used in real attacks and no listing on the U.S. CISA catalog of actively exploited vulnerabilities (KEV). Even so, a vulnerability-management product is a chokepoint where an organization's weakness data collects — a high-value target. You can check how far attacks are spreading in our tracker of actively exploited vulnerabilities (Japanese).

FAQ

Summary

Tenable Security Center, a vulnerability-management product, has four serious flaws. CVE-2026-64878 and CVE-2026-64879 (both 9.9) are OS command injections that reach server takeover after login; CVE-2026-64877 (9.6) is a SQL injection that lets even a low-privileged user pull sensitive data from the internal database; CVE-2026-64881 (8.8) is a further command injection that requires chaining. Exploitation needs a login, so it isn't a no-auth mass-scan case — but "one valid account and you reach takeover" is not to be dismissed.

The fix is to update to Security Center 6.8.0 or apply the standalone patch SC202607.1 for the 6.x line. Also audit user accounts, enforce MFA, and restrict console reachability. Security Center is the "command center" where weakness data collects, so a takeover spreads widely. Since leaving even one open can lead to server takeover, don't put the update off.

Sources

• ▸ NVD - CVE-2026-64878 (OS command injection in the analysis API)
• ▸ NVD - CVE-2026-64879 (OS command injection in audit-file upload)
• ▸ NVD - CVE-2026-64877 (SQL injection in the ticketing API)
• ▸ NVD - CVE-2026-64881 (OS command injection in audit-file upload, needs chaining)
• ▸ Tenable - Security advisories (fix 6.8.0 / patch SC202607.1)
• ▸ Tenable Security Center product page
• ▸ Related: tracker of actively exploited vulnerabilities, CISA KEV (Japanese, this site)