CVE-2026-19628

HighCVSS 7.2/10Last modified Aug 19, 2026

Description

A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Tenable, Inc.	Security Center	< 6.9.0

References

https://www.tenable.com/security/tns-2026-22Vendor Advisory

Timeline

Published: Aug 14, 2026
Last modified: Aug 19, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-196298.1A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" per CVE-2026-19639.8A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachmen CVE-2026-196307.5In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by CVE-2026-196314.9A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, po CVE-2026-196329.8The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure i CVE-2026-196338.8PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain CVE-2026-196346.4PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing CVE-2026-196358.8A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could a CVE-2026-196365.3An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a securi CVE-2026-196394.3An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings o CVE-2026-19645.3A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endp CVE-2026-196404.2On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive inco