CVE-2026-64878

Received Received - Intake

Command Injection in Tenable Nessus via Analysis REST Endpoint

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Tenable Network Security, Inc.

Description

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-64878

Affected Vendors & Products

Vendor	Product	Version / Range
tenable	security_center	6.6.0
tenable	security_center	6.7.2
tenable	security_center	6.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability involves unvalidated input in asset filter parameters that allows shell metacharacters to bypass command argument handling. This can lead to remote code execution with the privileges of a low-privileged operating system user through the Analysis REST endpoint.

Impact Analysis

An attacker could exploit this to execute arbitrary commands on the system, potentially gaining control over it. This may result in unauthorized data access, system compromise, or disruption of services, even with low user privileges.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality requirements in GDPR and HIPAA. Non-compliance risks include legal penalties, reputational damage, and loss of trust due to potential data breaches.

Mitigation Strategies

Apply the latest security patch from Tenable for affected versions to address the unvalidated input issue in asset filter parameters. Monitor Tenable's official security advisories for updates and ensure all third-party components are updated to their latest versions.

Hi! I’m here to help you understand CVE-2026-64878. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70