This vulnerability (CVE-2026-19681) in Tenable Security Center involves improper neutralization of special elements used in OS commands (CWE-78) during file upload processing. An authenticated user can upload a specially crafted file that triggers arbitrary command execution on the host OS. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vendor has not published any patch or remediation details yet, and the affected versions are not specified.

Successful exploitation allows an authenticated attacker to execute arbitrary operating system commands on the underlying server hosting Tenable Security Center. This can lead to full system compromise, including unauthorized access, data disclosure, modification, or destruction, and disruption of service. The critical CVSS score reflects the high severity of this impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to trusted personnel only and monitor for suspicious file uploads. Avoid uploading untrusted files to the Security Center. Follow vendor updates closely for patches or official mitigations.