This vulnerability involves improper neutralization of special elements used in OS command execution (CWE-78) within Tenable Security Center. Specifically, the filename parameter in the audit file upload feature is not sanitized, enabling an attacker with limited privileges to inject arbitrary shell commands. The vulnerability is remotely exploitable without user interaction and can lead to complete system compromise. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality, integrity, and availability with high severity. No official remediation or patch has been disclosed yet.

Successful exploitation allows an attacker with limited privileges to execute arbitrary OS commands on the affected system via the audit file upload functionality. This can lead to full system compromise, including unauthorized access, data disclosure, modification, or denial of service. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the audit file upload functionality to trusted users only and monitor for suspicious activity related to file uploads. Avoid uploading files with untrusted filenames and consider implementing additional input validation or sandboxing measures if possible.