EN PT-BR
← Voltar ao feed
high exploit público

CERT-FR: Tenable Security Center and Enclave Security RCE flaws CVE-2026-109618 and CVE-2026-109619, patch updated to SC-202610.2

1 fonte(s) · 2 atualização(ões) · publicado 22/10/2026 21:00 · coletado há 5 dias

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que a fonte trouxe em 29/10/2026 00:04; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ×2 ↗

CERT-FR warned of multiple vulnerabilities in Tenable Security Center and Tenable Enclave Security that could let an attacker achieve remote arbitrary code execution. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. The first advisory, CERTFR-2026-AVI-1370 (published 23 October 2026), covered versions without patch SC-202610.1 and cited Tenable bulletins tns-2026-28 and tns-2026-29 (22 October 2026) (cert.cyber.gouv.fr). A second advisory (26 October 2026) covers the same products and CVEs but refers to patch SC-202610.2 and bulletins tns-2026-30 and tns-2026-31 (23 October 2026) (cert.cyber.gouv.fr). Neither advisory reports active exploitation, and neither gives CVSS scores or technical detail. The later advisory is the more current, so defenders should treat SC-202610.2 as the target patch.

Entenda a falha

A vulnerabilidade

CERT-FR reports multiple vulnerabilities in Tenable Security Center and Tenable Enclave Security, tracked as CVE-2026-109618 and CVE-2026-109619, that let an attacker achieve remote arbitrary code execution. The advisories give no CVSS scores, no component, and no word on authentication, configuration or user interaction. The first advisory (23 October) listed all versions without patch SC-202610.1. The later one (26 October) lists versions without patch SC-202610.2, so that is the target. Fixes are in Tenable bulletins tns-2026-30 and tns-2026-31.

Como funciona

The articles do not describe how the vulnerable process works. They only say the flaws allow remote code execution, with no information on the input, the component that handles it, or the step where it fails.

Por que é vulnerável

The root cause is not stated in the advisories or the story, and neither is the bug class of each CVE or why the flaws went unnoticed. The fix ships as patch SC-202610.2, which replaced SC-202610.1 in the CERT-FR advisory. The sources do not explain what either patch changes in the code, or why the patch level changed.

Como foi descoberta

The articles do not say who found the flaws or how. CERT-FR published advisory CERTFR-2026-AVI-1370 on 23 October 2026, citing Tenable bulletins tns-2026-28 and tns-2026-29 (22 October). It then published CERTFR-2026-AVI-1381 on 26 October, citing tns-2026-30 and tns-2026-31 (23 October). Neither explains the change, and neither reports active exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 00:19.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

    PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

    This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

    CVE-2026-109618 · autor: OffSec · explicação gerada por IA

Detalhes técnicos

  • CVEs: CVE-2026-109618 and CVE-2026-109619.
  • Impact: remote arbitrary code execution. Whether authentication is required is not stated (cert.cyber.gouv.fr).
  • Affected: Tenable Security Center and Tenable Enclave Security, in versions without the patch named in the relevant advisory.
  • No IOCs, threat actors, exploitation details or CVSS scores are provided.

Remediação

  • Apply the fixes in the Tenable security bulletins, including patch SC-202610.2, as CERT-FR directs in its most recent advisory (cert.cyber.gouv.fr).
  • Systems patched only with SC-202610.1 should be checked against the newer bulletins (tns-2026-30 and tns-2026-31) to confirm whether SC-202610.2 is also needed. The sources do not say how the two patches relate.

Relatos divergentes

  • Patch level: the 23 October advisory says SC-202610.1 (cert.cyber.gouv.fr). The 26 October advisory says SC-202610.2 (cert.cyber.gouv.fr). The 26 October advisory is more recent and should be preferred.
  • Vendor bulletins: tns-2026-28 and tns-2026-29, dated 22 October, in the first advisory. tns-2026-30 and tns-2026-31, dated 23 October, in the second (cert.cyber.gouv.fr). Neither source explains the change, for example whether the later bulletins supersede the earlier ones or whether SC-202610.1 was found insufficient.
  • Exploitation status: both advisories report no active exploitation.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 25/10/2026 21:00 · coletado 27/10 13:01

    CERT-FR: Tenable Security Center and Enclave Security vulnerabilities allow remote code execution (CVE-2026-109618, CVE-2026-109619)

    ler a análise desta fonte

    CERT-FR published an advisory on multiple vulnerabilities in Tenable products, specifically Enclave Security and Security Center without patch SC-202610.2. According to the advisory, an attacker could exploit them to achieve remote arbitrary code execution. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are covered by Tenable bulletins tns-2026-30 and tns-2026-31, both dated 23 October 2026. The advisory does not report active exploitation and gives no CVSS scores or technical detail.

    Technical Details

    • Affected: Tenable Enclave Security and Tenable Security Center without patch SC-202610.2.
    • Impact: remote arbitrary code execution.
    • Vendor bulletins: tns-2026-30 and tns-2026-31 (23 October 2026).
    • No IOCs, threat actors or exploitation details are provided.

    Remediation

    • Apply the fixes described in the Tenable security bulletins, including patch SC-202610.2, as CERT-FR directs.
  2. cert.cyber.gouv.fr ↗ · pub. 22/10/2026 21:00 · coletado 27/10 13:01 primeiro registro

    CERT-FR flags multiple remote code execution vulnerabilities in Tenable Security Center and Enclave Security

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1370 on multiple vulnerabilities in Tenable products that could let an attacker achieve remote arbitrary code execution. The affected products are Tenable Security Center and Tenable Enclave Security, in all versions without patch SC-202610.1. The advisory refers to the vendor bulletins tns-2026-28 and tns-2026-29, both dated 22 October 2026, and to two CVEs. It reports no active exploitation and gives no CVSS scores or technical detail.

    Technical Details

    • CVEs referenced: CVE-2026-109618 and CVE-2026-109619.
    • Impact class: remote arbitrary code execution. The advisory does not state whether authentication is required.
    • Affected: Tenable Security Center and Tenable Enclave Security, all versions without patch SC-202610.1.

    Remediation

    • Apply patch SC-202610.1 as described in Tenable bulletins tns-2026-28 and tns-2026-29, as CERT-FR directs.