CVE-2026-64880 Details
Description
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.
A blind SQL injection vulnerability has been identified in Tenable Security Center versions 6.6.0 through 6.8.0. This issue arises from unsanitized user input in report filtering parameters, which is directly concatenated into SQL queries without proper escaping or the use of parameterized queries. As a result, this vulnerability allows for unauthorized database read access.
Tenable has released a security patch (SC202607.1) for this vulnerability. The patch is available through the Tenable Downloads Portal.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.tenable.com/security/tns-2026-19 | [email protected] | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tenable security center | >= 6.6.0, <= 6.8.0 |
CPE
Remediation
| |
| linux linux kernel | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 18, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | CVE Modified | [email protected] |
| Jul 21, 2026 | New CVE Received | [email protected] |