CVE-2026-19681
Command Injection
Updated
- CVSS 3.1
- 9.9 CRITICAL
- EPSS
- 4.2% (91st pct)
- CISA KEV
- Not listed
- Published
- 2026-08-14
- Weakness
- CWE-78
Description
An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.
Key Findings
as of 2026-11-12- Its current EPSS score (4.2%) is higher than that of 15% of CISA KEV entries.
Severity
CVSS 3.1 · CNA · Base score9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CVSS calculator CVSS 4.0 · CNA · CVSS-B9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HOpen in CVSS calculator SSVC · CISA-ADP
Exploitationnone
Automatableno
Technical impacttotal
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Tenable, Inc. | Tenable, Inc. Security Center | 0 to <6.9.0 |
References
1 linksVendor advisories
Record Details
- Published
- 2026-08-14
- Last updated
- 2026-08-15
- Assigner (CNA)
- tenable
- Credited to
- -
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.