PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64880 Tenable, Inc. CVE debrief

CVE-2026-64880 is a high-severity blind SQL injection vulnerability. The issue arises from unsanitized user-supplied input in report filtering parameters being concatenated directly into SQL queries without proper escaping or parameterized queries. This allows for unauthorized database read access. The CVE record was published on 2026-07-21T20:17:04.900Z and was last modified on 2026-07-22T20:35:40.827Z.

Vendor
Tenable, Inc.
Product
Security Center
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-08-18
Advisory published
2026-07-21
Advisory updated
2026-08-18

Who should care

Security teams and administrators responsible for database security and report filtering systems should be aware of this vulnerability. The high severity of 7.1 indicates significant risk, especially in environments where database access could lead to sensitive information disclosure.

Technical summary

The vulnerability is caused by the lack of proper input sanitization and secure query practices in report filtering parameters. An attacker could exploit this by crafting malicious input to inject SQL commands, potentially leading to unauthorized database reads. The CVSS score of 7.1 reflects the high severity of this issue, with AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

High priority should be given to patching or mitigating this vulnerability. Defensive measures include validating and sanitizing all user-supplied input, especially in filtering parameters, and ensuring the use of parameterized queries or prepared statements to prevent SQL injection.

Recommended defensive actions

  • Validate and sanitize all user-supplied input in report filtering parameters.
  • Implement parameterized queries or prepared statements for SQL queries.
  • Review and update database access controls to limit potential damage.
  • Monitor database activity for suspicious query patterns.
  • Apply patches or updates provided by the vendor as soon as available.

Evidence notes

The CVE record and NVD detail provide the primary sources for this information. The Tenable security report (TNS-2026-19) is also referenced, though its direct content is not verified. Further investigation and verification are recommended to fully understand the scope and impact of this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64880 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64880

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64880 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64880

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.