CVE-2026-64880: Blind SQL Injection
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tenable Security Centerto a version that resolves this vulnerability.Patch SC202607.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64880?
The severity of CVE-2026-64880 is rated as high with a score of 7.1.
What type of vulnerability is CVE-2026-64880?
CVE-2026-64880 is a blind SQL injection vulnerability.
How does CVE-2026-64880 occur?
CVE-2026-64880 occurs due to unsanitized user-supplied input being concatenated directly into SQL queries.
What are the potential consequences of CVE-2026-64880?
CVE-2026-64880 can lead to unauthorized database read access.
How can CVE-2026-64880 be mitigated?
CVE-2026-64880 can be mitigated by implementing proper input validation and using parameterized queries.