CVE-2026-2697
Last modified
CVE-2026-2697 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tenable | Security Center | < 6.8.0 |
References
- https://www.tenable.com/security/tns-2026-07Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-2697?
How severe is CVE-2026-2697?
How do I fix CVE-2026-2697?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-26961Rack is a modular Ruby web server interface. Prior to versio…5.3
- CVE-2026-26962Rack is a modular Ruby web server interface. From version 3.…6.5
- CVE-2026-26963Cilium is a networking, observability, and security solution…5.4
- CVE-2026-26964Windmill is an open-source developer platform for internal c…2.7
- CVE-2026-26965FreeRDP is a free implementation of the Remote Desktop Proto…8.8
- CVE-2026-26967PJSIP is a free and open source multimedia communication lib…5.3
- CVE-2026-26972OpenClaw is a personal AI assistant. In versions 2026.1.12 t…6.7
- CVE-2026-26973Discourse is an open source discussion platform. Versions pr…4.3
- CVE-2026-26974Slyde is a program that creates animated presentations from …9.8
- CVE-2026-26975Music Assistant is an open-source media library manager that…8.8
- CVE-2026-26977Frappe Learning Management System (LMS) is a learning system…5.3
- CVE-2026-26978FreePBX is an open source IP PBX. In versions below 16.0.71 …8.6
Are you affected by CVE-2026-2697?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST