This vulnerability (CVE-2026-64881) in Tenable Security Center involves improper neutralization of special elements used in OS commands (CWE-78). Specifically, the audit file upload handler fails to sanitize filenames, allowing shell metacharacters to be injected into system commands. This input validation failure enables an attacker to perform OS command injection when chained with another related vulnerability. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been provided, and no affected versions are specified.

Successful exploitation could allow an attacker with low privileges to execute arbitrary OS commands on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the Security Center environment. The vulnerability affects system command execution via unsanitized filenames in the audit file upload handler. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with audit file uploads and restrict access to the upload functionality to trusted users only. Monitor vendor communications for updates on patches or mitigations.