Paper/Archive/CVE-2026-64879

CVE-2026-64879

Tenable, Inc. Security Center — Command Injection

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 83.0.830 × 2016.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

Affected

ProductAffectedFixed inSource

Security Centersee advisory–CNA

Scores by source

tenable (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

tenable (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reftenable.com/security/tns-2026-19