Dashboard / CVE-2026-64879

CVE-2026-64879

CRITICAL
INFO Priority: 0.21 BB Relevance: 69/100
Published: 2026-07-21 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
tenable security_center 6.6.0 – 6.8.0

References & Advisories (1)

Bug Bounty Relevance

69 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

9.4 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

2.26%
Raw Score 0.022610
Percentile 82.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.02261
2026-10-28
0.02261

Intelligence Sources

nvd ref →

External Links