CVE-2026-19626 is a remote code execution vulnerability in Tenable Security Center's report generation feature. It allows an authenticated user with non-administrative privileges to execute arbitrary code on the server by providing specially crafted input that is processed insecurely during report rendering. This vulnerability stems from unsafe handling of user input, classified under CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code). The exploit results in code execution with the service account's privileges, posing a critical security risk.

Successful exploitation leads to arbitrary code execution on the server hosting Tenable Security Center, with the privileges of the service account. This can compromise confidentiality, integrity, and availability of the system and potentially the broader network environment. The vulnerability requires authentication but no administrative privileges, increasing the risk from lower-privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Tenable Security Center to trusted users only and monitor for suspicious activity related to report generation. Avoid granting unnecessary report generation permissions to non-administrative users.