This vulnerability (CVE-2026-19679) in Tenable Security Center arises from improper neutralization of special elements in uploaded filenames, classified as CWE-78 (OS command injection). The flaw occurs during file upload handling where insufficient sanitization allows crafted filenames to influence downstream OS commands. This can enable an attacker with low privileges to execute arbitrary commands on the underlying system, impacting confidentiality, integrity, and availability. The vulnerability is publicly disclosed with a high CVSS 3.1 score of 8.8. No vendor advisory or patch information is currently available, and the affected versions have not been specified.

Successful exploitation could allow an attacker with limited privileges to execute arbitrary OS commands on the system running Tenable Security Center. This can lead to full compromise of the affected system, including unauthorized data access, modification, or service disruption. The vulnerability affects confidentiality, integrity, and availability of the system. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with file uploads and restrict access to the Security Center to trusted users only. Monitor vendor communications for updates on patches or mitigations.