This vulnerability (CVE-2026-64879) in Tenable Security Center involves improper neutralization of special elements used in OS commands (CWE-78). Specifically, the filename parameter in the audit file upload feature is not sanitized before being passed to system commands, enabling command injection. The CVSS 3.1 score of 9.9 reflects network attack vector, low attack complexity, required privileges, no user interaction, and complete compromise of confidentiality, integrity, and availability. No official remediation or patch information is available at this time.

Successful exploitation allows an attacker with limited privileges to execute arbitrary OS commands on the underlying system, potentially leading to full system compromise including data theft, modification, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the audit file upload functionality to trusted users only and monitor for suspicious activity related to file uploads. Avoid uploading untrusted files and consider isolating the affected system to limit potential impact.