CVE-2026-19636
Received Received - Intake

CSRF Token Predictability in Vulnerability Management Tool

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: Tenable Network Security, Inc.

Description
An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19636
EUVD
EUVD-2026-58736

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tenable security_center to 6.9.0 (exc)
tenable security_center 6.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1270 The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Cross-Site Request Forgery (CSRF) tokens being generated in a predictable way, which weakens their ability to protect against unauthorized actions. The issue was fixed by improving the randomness and entropy of token generation.

Detection Guidance

This vulnerability involves predictable CSRF tokens, which can be detected by reviewing token generation logic in web applications. Check if tokens are generated using weak or predictable methods. Inspect server-side code for token generation functions and verify entropy sources.

Impact Analysis

An attacker could exploit the predictable tokens to bypass CSRF protections, potentially tricking users into performing unintended actions on a vulnerable system. This could lead to unauthorized changes or data theft.

Mitigation Strategies

Update the token generation mechanism to use cryptographically secure random number generators. Ensure tokens have sufficient entropy and are not predictable. Review and patch any affected web applications or frameworks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19636. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart