CVE-2026-64881: Command Injection
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tenable Security Centerto a version that resolves this vulnerability.Patch SC202607.1
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack vector is network-based and requires low privileges. No user interaction is required.
Is an unsanitized audit-file filename alone enough to exploit the vulnerability?
The issue is described as requiring chaining with a related vulnerability. The provided information does not identify that related vulnerability or its additional prerequisites.
What is the potential impact of successful exploitation?
Successful exploitation can lead to high impact on confidentiality, integrity, and availability, consistent with command injection into system command execution.