CVE-2026-64879

critical · 9.4

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

9.4

CVSS

2.3%

EPSS (exploit prob.)

82nd

EPSS percentile

2026-07-21

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
tenable	security_center	>= 6.6.0, <= 6.8.0
linux	linux_kernel	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.tenable.com/security/tns-2026-19

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-64879