High CVSS 7.2
CVE-2026-19628
A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered.
What this means
- Exposure
- Exploitable remotely over the network, with a privileged account and with no action from the victim.
- Impact
- An attacker can read sensitive data, modify or destroy data and take the service offline.
- Weakness
- Unfiltered input reaches the system shell, letting the attacker run their own commands on the server.
- Likelihood
- Its EPSS score puts short-term exploitation in a middle band: neither negligible nor imminent.
What to doFold into the next patch cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.