Detections
Analytics
Tenable Security Center Multiple Vulnerabilities (TNS-2026-19)
high Nessus Plugin ID 328967
Language:
Synopsis
An instance of Security Center installed on the remote system is affected by multiple vulnerabilities.Description
According to its self-reported version, the Tenable Security Center running on the remote host is between 6.7.0 and 6.8.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-19 advisory.- Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use- after-free that may lead to remote code execution. This has been patched in version 8.6.3.
(CVE-2026-23479)
- Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3. (CVE-2026-25243)
- RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisTimeSeries module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This has been patched in version 1.12.14. (CVE-2026-25588)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Apply security patch SC-202607.1 or later.See Also
Plugin Details
Severity: High
ID: 328967
File Name: securitycenter_6_8_0_tns_2026_19_redis.nasl
Version: 1.3
Type: Combined
Agent: unix
Family: Misc.
Published: 7/22/2026
Updated: 8/5/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.9
Percentile: 99.35
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-25589
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 7.7
Threat Score: 6.8
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
CPE: cpe:/a:tenable:security_center
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/20/2026
Vulnerability Publication Date: 4/9/2024
Reference Information
CVE: CVE-2026-23479, CVE-2026-23631, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589