Auth SQLi in Ticketing REST API - Sensitive Data Leak
CVE-2026-64877 Published on July 21, 2026

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.

NVD

Vulnerability Analysis

CVE-2026-64877 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.


Products Associated with CVE-2026-64877

Want to know whenever a new CVE is published for Tenable Security Center? stack.watch will email you.

Tenable Security Center
 

Affected Versions

Tenable, Inc. Security Center: