AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

TenableCVE-2026-64879

Tenable: command injection

Tenable

CVE-2026-64879 · Published Jul 21, 2026 · updated Aug 18, 2026

Critical9.4
No fix yet
Tenable advisory

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-78

More Tenable advisories

All Tenable
Medium 6.4Jul 29Tenable Link Library: cross-site scriptingCVE-2026-18197fixed in 7.9.4High 8.7Jul 21Tenable Security Center: command injectionCVE-2026-64881fixed in 6.8.0Critical 9.4Jul 21Tenable Security Center: remote code executionCVE-2026-64878fixed in 6.8.0High 7.1Jul 21Tenable Security Center: SQL injectionCVE-2026-64880fixed in 6.8.0Critical 9.4Jul 21Tenable: SQL injectionCVE-2026-64877no fix yetCritical 9.4Jul 14tenable_agent: path traversalCVE-2026-15265no fix yet