This vulnerability (CVE-2026-64878) involves improper neutralization of special elements used in OS commands (CWE-78) within Tenable Security Center. Specifically, unvalidated input in asset filter parameters permits shell metacharacters to escape intended command argument handling, leading to remote code execution as a low-privileged OS user through the Analysis REST endpoint. The CVSS 3.1 score of 9.9 reflects network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No official remediation or patch information is currently available, and no exploits are known in the wild.

Successful exploitation allows an attacker to execute arbitrary OS commands remotely with low-privileged user rights, potentially compromising system confidentiality, integrity, and availability. Given the critical CVSS score, this vulnerability poses a severe risk to affected deployments of Tenable Security Center. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Analysis REST endpoint and validate or sanitize input parameters where possible to reduce exposure.