CVE-2026-64878

CRITICAL CVSS 9.9 View on NVD ↗

Description

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://www.tenable.com/security/tns-2026-19

Published: Jul 21, 2026 20:17 UTC Modified: Jul 21, 2026 20:17 UTC