PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64877 Tenable, Inc. CVE debrief

CVE-2026-64877 is a SQL injection vulnerability in the ticketing REST API of an appliance. An authenticated non-admin user can exploit this flaw to access sensitive data stored in the appliance database. The CVSS score for this vulnerability is 9.4, indicating a critical severity level. The vulnerability exists due to improper input validation in the ticketing REST API, allowing malicious SQL code injection. This could lead to unauthorized access to sensitive data stored in the appliance database. Security teams and administrators should prioritize patching this vulnerability to prevent potential data breaches.

Vendor
Tenable, Inc.
Product
Security Center
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-08-18
Advisory published
2026-07-21
Advisory updated
2026-08-18

Who should care

Security teams and administrators responsible for the affected appliance should prioritize patching this vulnerability to prevent potential data breaches. Operators and platform administrators should review the vulnerability's impact on their environments and plan for necessary updates or mitigations.

Technical summary

The vulnerability exists in the ticketing REST API, allowing an authenticated non-admin user to inject malicious SQL code. This could lead to unauthorized access to sensitive data stored in the appliance database. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

High

Recommended defensive actions

  • Apply the vendor's official patch or update to fix the SQL injection vulnerability
  • Implement additional monitoring and logging to detect potential exploitation attempts
  • Restrict access to the ticketing REST API to only necessary personnel
  • Perform regular security audits and vulnerability assessments
  • Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record was published on 2026-07-21T19:17:13.340Z and last modified on 2026-07-22T20:35:40.827Z. The NVD entry is currently Awaiting Analysis. This SQL injection vulnerability in the ticketing REST API allows an authenticated non-admin user to access sensitive data. Evidence is limited, and defenders should verify the affected scope and vendor guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64877 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64877

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64877 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64877

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.