PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64877 Tenable, Inc. CVE debrief

CVE-2026-64877 is a SQL injection vulnerability in the ticketing REST API of an appliance. An authenticated non-admin user can exploit this flaw to access sensitive data stored in the appliance database. The CVSS score for this vulnerability is 9.4, indicating a critical severity level. The vulnerability exists due to improper input validation in the ticketing REST API, allowing malicious SQL code injection. This could lead to unauthorized access to sensitive data stored in the appliance database. Security teams and administrators should prioritize patching this vulnerability to prevent potential data breaches.

Vendor
Tenable, Inc.
Product
Security Center
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Security teams and administrators responsible for the affected appliance should prioritize patching this vulnerability to prevent potential data breaches. Operators and platform administrators should review the vulnerability's impact on their environments and plan for necessary updates or mitigations.

Technical summary

The vulnerability exists in the ticketing REST API, allowing an authenticated non-admin user to inject malicious SQL code. This could lead to unauthorized access to sensitive data stored in the appliance database. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

High

Recommended defensive actions

  • Apply the vendor's official patch or update to fix the SQL injection vulnerability
  • Implement additional monitoring and logging to detect potential exploitation attempts
  • Restrict access to the ticketing REST API to only necessary personnel
  • Perform regular security audits and vulnerability assessments
  • Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record was published on 2026-07-21T19:17:13.340Z and last modified on 2026-07-22T20:35:40.827Z. The NVD entry is currently Awaiting Analysis. This SQL injection vulnerability in the ticketing REST API allows an authenticated non-admin user to access sensitive data. Evidence is limited, and defenders should verify the affected scope and vendor guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T19:17:13.340Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.