CVE-2026-19636

Analyzed Analyzed - Analysis Complete

CSRF Token Predictability in Vulnerability Management Tool

Publication date: 2026-08-14

Last updated on: 2026-08-19

Assigner: Tenable Network Security, Inc.

Description

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-14

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-02

NVD

CVE-2026-19636

EUVD

EUVD-2026-58736

Affected Vendors & Products

Vendor	Product	Version / Range
tenable	security_center	to 6.9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1270	The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.

Attack-Flow Graph

Executive Summary

This vulnerability involves Cross-Site Request Forgery (CSRF) tokens being generated in a predictable way, which weakens their ability to protect against unauthorized actions. The issue was fixed by improving the randomness and entropy of token generation.

Detection Guidance

This vulnerability involves predictable CSRF tokens, which can be detected by reviewing token generation logic in web applications. Check if tokens are generated using weak or predictable methods. Inspect server-side code for token generation functions and verify entropy sources.

Impact Analysis

An attacker could exploit the predictable tokens to bypass CSRF protections, potentially tricking users into performing unintended actions on a vulnerable system. This could lead to unauthorized changes or data theft.

Compliance Impact

The vulnerability involves predictable CSRF tokens, which could reduce the effectiveness of security controls. This may impact compliance with standards requiring strong authentication and session management, such as GDPR (data protection) and HIPAA (healthcare data security), by potentially allowing unauthorized actions. However, specific compliance impacts are not detailed in the provided context.

Mitigation Strategies

Update the token generation mechanism to use cryptographically secure random number generators. Ensure tokens have sufficient entropy and are not predictable. Review and patch any affected web applications or frameworks.

Hi! I’m here to help you understand CVE-2026-19636. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70