CVE-2026-64879: Security Center: işletim sistemi komut enjeksiyonu

Açıklama (NVD)

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

Özet bilgiler

Ürün

Tenable Security Center

CVSS v3.1

9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v4.0

9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

%2,26 (yüzdelik 83)

CWE

CWE-78

Yama

Mevcut

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• www.tenable.com
• CWE-78