CVE-2026-19626

Katalog CVE

CVSS 9.9 · Critical EPSS 1,9%

Kerentanan Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') pada tenable security center. Skor CVSS 3.1 9.9 (Critical) menurut tenable.com.

Deskripsi (NVD)

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.

Rincian

Terbit di NVD

14 Agustus 2026

Terakhir diubah

19 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber tenable.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 78,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.tenable.com/security/tns-2026-22 advisory vendor