This vulnerability (CVE-2026-19626) affects Tenable Security Center and arises from improper neutralization of directives in dynamically evaluated code, classified as CWE-95. Specifically, the report generation functionality processes user-supplied input unsafely during server-side rendering, allowing an authenticated, non-administrative user to execute arbitrary code with the privileges of the service account. The CVSS 3.1 base score is 9.9, reflecting critical severity with network attack vector, low attack complexity, required privileges, no user interaction, and complete confidentiality, integrity, and availability impact. No patch or official remediation information is currently provided by the vendor.

Successful exploitation allows an authenticated non-administrative user to execute arbitrary code on the server hosting Tenable Security Center with the privileges of the service account. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. Given the high CVSS score (9.9), the vulnerability poses a critical risk to affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the report generation functionality to trusted users only and monitor for suspicious activity. Avoid granting unnecessary privileges to users who can access this feature.