CVE-2026-19626 Tenable, Inc. CVE debrief

Who should care

Administrators and users of Tenable Security Center, especially those with non-administrative privileges, should verify and apply vendor remediation. Security teams and vulnerability management teams should review the vulnerability and assess their exposure. Operators of affected systems should prioritize remediation and review compensating controls.

Technical summary

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account. The vulnerability has a CVSS score of 9.4 and a CRITICAL severity rating.

Defensive priority

Authenticated users with non-administrative privileges could exploit this critical remote code execution vulnerability in Tenable Security Center's report generation functionality.

Recommended defensive actions

• Verify and apply vendor remediation for Tenable Security Center
• Restrict access to report generation functionality
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Further verification is recommended. The vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue. The service account privileges are used for arbitrary code execution. Limited source detail is available. Evidence limits should be considered when verifying this issue.

Official resources