This vulnerability (CVE-2026-64877) affects Tenable Security Center and is caused by improper input validation in the ticketing REST API. An authenticated user without administrative privileges can exploit a SQL injection flaw to access sensitive database information. The CVSS v3.1 score is 8.4, indicating high impact with low attack complexity and privileges required. The vulnerability affects the confidentiality and integrity of data but does not impact availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows an authenticated non-admin user to perform SQL injection attacks on the ticketing REST API, leading to unauthorized access to sensitive data stored in the appliance database. This compromises confidentiality and integrity of data within the affected system. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the ticketing REST API to trusted users only and monitor for suspicious activity. Avoid granting unnecessary privileges to non-admin users to reduce exploitation risk.