{"id":"CVE-2026-64879","state":"PUBLISHED","title":"Command Injection","description":"A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.","publishedAt":"2026-07-21T19:54:06.008Z","updatedAt":"2026-07-24T03:55:54.833Z","severity":{"score":9.4,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","source":"tenable"},"assigner":"tenable","products":["Tenable, Inc. Security Center"],"affected":[{"vendor":"Tenable, Inc.","product":"Security Center","defaultStatus":"affected","versions":[{"version":"0","status":"unaffected","lessThan":"6.8.0","changes":[{"at":"Patch SC202607.1","status":"unaffected"}],"versionType":"semver"}],"platforms":["Linux"]}],"references":["https://www.tenable.com/security/tns-2026-19"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64879.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64879","state":"PUBLISHED","datePublished":"2026-07-21T19:54:06.008Z","dateUpdated":"2026-07-24T03:55:54.833Z","assignerShortName":"tenable","assignerOrgId":"5ac1ecc2-367a-4d16-a0b2-35d495ddd0be","dateReserved":"2026-07-20T19:19:24.798Z"},"containers":{"cna":{"title":"Command Injection","descriptions":[{"lang":"en","value":"A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality."}],"affected":[{"vendor":"Tenable, Inc.","product":"Security Center","defaultStatus":"affected","versions":[{"version":"0","status":"unaffected","lessThan":"6.8.0","changes":[{"at":"Patch SC202607.1","status":"unaffected"}],"versionType":"semver"}],"platforms":["Linux"]}],"references":[{"url":"https://www.tenable.com/security/tns-2026-19"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9.9,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.4,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"tenable","orgId":"5ac1ecc2-367a-4d16-a0b2-35d495ddd0be","dateUpdated":"2026-07-21T19:54:06.008Z"},"solutions":[{"lang":"en","value":"Tenable has released Security Center Patch SC202607.1 to address these issues. The installation files can be obtained from the Tenable Downloads Portal:  https://www.tenable.com/downloads/security-center","supportingMedia":[{"type":"text/html","base64":false,"value":"Tenable has released Security Center Patch SC202607.1 to address these issues. The installation files can be obtained from the Tenable Downloads Portal:&nbsp;<a href=\"https://www.tenable.com/downloads/security-center\" title=\"Downloads\">https://www.tenable.com/downloads/security-center</a>"}]}],"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-23T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-64879"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-24T03:55:54.833Z"}}]}}}