// CVE · PUBLISHED 2026-07-21
CVE-2026-64878 Tenable, Inc. / Security Center
9.4 · CVSS 4.0 Critical
Description Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.
Details Products Tenable, Inc. / Security Center Published 21 Jul 2026 Modified 24 Oct 2026 CVSS 9.4 Critical (v4.0) Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Score source vulnreport@tenable.com CWE CWE-78 Record status Analyzed