CVE-2026-64877

HIGH

Tenable, Inc. Security Center < 6.8.0 - Improper Input Validation

Title source: rule
STIX 2.1

Description

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.

References (1)

Core 1

Scores

CVSS v3 8.4
EPSS 0.0019
EPSS Percentile 9.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-20
Status published
Products (1)
Tenable, Inc./Security Center < 6.8.0
Published Jul 21, 2026
Tracked Since Jul 22, 2026