CVE-2026-19626: tenable, inc. security center Eval Injection

Vulnerability summary

CVE-2026-19626 is a critical (CVSS 9.9) Eval Injection vulnerability in tenable, inc. security center. EPSS estimates a 1.85% chance of exploitation in the next 30 days, higher than 78.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 14-08-2026
   PublishedVulnerability first disclosed.
2. 15-08-2026
   Last modifiedVulnerability information updated.

Description

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.

• CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").