What’s Vulnerable › Vulnerabilities

CVE-2026-64879: Command Injection

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-21 · updated 2026-10-24
• Weakness: CWE-78

Description

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

Affected products

• Tenable, Inc. Security Center: from 6.6.0 through 6.8.0

References

• https://www.tenable.com/security/tns-2026-19

Get alerted when CVE-2026-64879 or the next vulnerability affects your stack