# Multiple critical vulnerabilities in Tenable Security Center

Published: 2026-08-14 · Severity: high
Canonical: https://vorant.io/reports/e6a0f1d1-2158-5cf7-9485-c40f316f3051/multiple-critical-vulnerabilities-in-tenable-security-center

> Tenable Security Center versions before 6.9.0 contain multiple vulnerabilities enabling remote code execution, privilege escalation, and SQL injection.

CERT-FR has issued an advisory documenting multiple vulnerabilities affecting Tenable Security Center versions prior to 6.9.0. The vulnerabilities span several impact categories including remote code execution, privilege escalation, SQL injection, denial of service, and security policy bypass. The advisory references 19 distinct CVE identifiers, indicating a significant cluster of flaws in this widely-deployed vulnerability management platform. Organizations running affected versions of Security Center should prioritize upgrading to version 6.9.0 or later as outlined in Tenable's security bulletin TSN-2026-22 published 13 August 2026. The remote code execution and privilege escalation vectors are particularly critical given Security Center's role as a central security control point in many enterprise environments.

## Mentioned in this report

- Vulnerabilities: CVE-2026-11564, CVE-2026-11586, CVE-2026-11856, CVE-2026-12064, CVE-2026-19626 (weaponized), CVE-2026-19628, CVE-2026-19629, CVE-2026-19631, CVE-2026-19635, CVE-2026-19636, CVE-2026-19639, CVE-2026-19679, CVE-2026-19680, CVE-2026-19681 (weaponized), CVE-2026-19682, CVE-2026-27601, CVE-2026-3784, CVE-2026-4873, CVE-2026-5545, CVE-2026-5773

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1023

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e6a0f1d1-2158-5cf7-9485-c40f316f3051/multiple-critical-vulnerabilities-in-tenable-security-center.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup