Tenable Security Center 2026 Release Notes

Apply the patch to a standalone Tenable Security Center or Tenable Core + Tenable Security Center:

1. Download the patch from the Tenable Security Center Downloads page to Tenable Security Center. You can save the files in any location (for example, /tmp).

2. Access the command line as a user with root-level permissions.

3. Run the following command to untar the patch file, where [patch file name] is the name of the .tgz patch file you downloaded:

   tar zxf [patch file name]

4. Run the following command to change the directory to the extracted directory, where [directory] is the extracted directory:

   cd [directory]

5. Run the following command to begin the installation:

   sh ./install.sh

   The installation begins and Tenable Security Center stops.

6. After the installation finishes, you must restart Tenable Security Center.

What to do next:

• (Optional) Confirm the patch successfully applied to Tenable Security Center, as described in the knowledge base article.

All versions:

• install.sh

• Analysis.php

• defines.php

• Files.php

• Users.php

• AuthenticationLib.php

• ConfigurationLib.php

• LCELib.php

• ReportChartingLib.php

• ReportGenerateLib.php

• ScanDBLib.php

• ScanResultLib.php

• Utility.php

• VulnLib.php

• customPassivePluginUpload.php

• customPluginUpload.php

• IDSSignatures.php

• passivePluginUpdate.php

• pluginUpdate.php

• ParseNessusFileTool.php

• ParseScanDBFileTool.php

• rest.php

Tenable Security Center 6.7.2, 6.7.5, and 6.8.0 only:

• ReportFileReceiverLib.php

• wasPluginUpdate.php

Tenable Security Center 6.8.0 only:

• ScEncClient.php

Filenames and MD5 or SHA-256 checksums are located on the Tenable Security Center Downloads page.

Compatibility and Requirements

• Version Support: Tenable Security Center 6.9.0 supports direct upgrades from version 6.5.0 and later on the same operating system. If your upgrade skips versions (for example, 6.7.0 to 6.9.0), review the release notes for all skipped versions to identify necessary configuration updates.

• Hardware: Tenable Security Center has updated hardware specifications as of version 6.7.0. While the upgrade does not block systems that fall below these specs, performance may degrade. Tenable Support may require hardware upgrades to resolve support cases.

  For more information, see Hardware Requirements in the Tenable Security Center User Guide.

  • 8GB of RAM or higher is required for Tenable Security Center 6.9.0 and higher. Upgrades and new installs will not proceed if the system has less than 8GB RAM.

  • When you run the RPM installer from the /tmp directory and /tmp is on its own partition, /tmp must have at least 10 GB of free space.

• Deprecations:

  • Kubernetes: support ended in version 6.6.0. When you upgrade Tenable Security Center, you must migrate to Tenable Enclave Security.

  • Web App Scanning using Tenable Nessus was deprecated in version 6.7.0. When you upgrade Tenable Security Center, you must move to Tenable Core or Docker-based scanners.

  • Ticketing: The Ticketing feature will be deprecated in a future release. Review the Integrations Documentation for options on integrating Tenable Security Center with external ticketing systems.

Pre-Upgrade Preparation

• Backups: Perform a backup before upgrading Tenable Security Center. For more information, see Perform a Backup in the Tenable Security Center User Guide.

• External PostgreSQL:

  • If you have an external PostgreSQL database, it must be running and reachable before you upgrade Tenable Security Center. Failure to do so will result in a failed upgrade of Tenable Security Center, even if the upgrade appears to succeed. If this occurs, you can restore the database with a preexisting backup file. Otherwise, you will need to contact your customer support representative to resolve the issue.

  • If you want to run a VACUUM operation in an external PostgreSQL, you must have super user or table owner permissions.

• Tenable Nessus Plugins: Verify that your Tenable Nessus plugins have been updated within the last 30 days.

During Upgrade

• Upgrade Duration: Upgrades from version 6.6.x or earlier with large datasets may take several hours. Tenable Security Center consoles with hundreds or thousands of Trending components in Reports may take several hours to complete the upgrade.

• Tenable Security Center Director: If you upgrade Tenable Security Center Director, upgrade all managed instances connected to Tenable Security Center Director. After upgrading, allow up to 15 minutes for your managed Tenable Security Center instances to sync with Tenable Security Center Director.

• Tiered Setups: When you upgrade to Tenable Security Center 6.9.0 with a tiered setup using remote or offline universal repositories, follow these steps:

  1. In the parent Tenable Security Center console, change the update frequency of each remote repository to Never.

  2. Upgrade the child and parent Tenable Security Center consoles that synchronize repositories to version 6.9.0.

  3. From the parent Tenable Security Center console, initiate a synchronization of the repositories.

  4. Verify the synchronization completes successfully and ensure the parent console displays the updated data.

  5. In the parent Tenable Security Center console, change the update frequency of each remote repository back to your previous setting (for example, Daily).

  For more information, see the Knowledge Base article.

• Offline Universal Repositories: Tenable Security Center 6.7.0 fixed an issue where DNS assets were broken for offline universal repositories, because you could not enter the IP range when adding the repository. When you upgrade Tenable Security Center from 6.6.x or earlier, the IP range for the offline universal repository is not automatically set. You must manually edit the offline repository and enter the IP range to use DNS assets.

Post-Upgrade and Maintenance

• Search and Vulnerability Intelligence: The feed update must complete successfully to enable Search and Vulnerability Intelligence. After you upgrade Tenable Security Center, verify the status of the feed update. If you cannot confirm that an automatic update occurred, manually trigger a feed update.

• Remote Repository Sync:

  • Enabling FIPS 140-2 on Oracle 8, RHEL 8, or Tenable Core requires re-authentication of Remote Repository Syncs.

    1. Download the RSA key from the Tenable Security Center host console: cat /opt/sc/.ssh/id_rsa.pub

    2. Upload the key to each remote Tenable Security Center. See Add a Key in the Tenable Security Center User Guide.

    3. Navigate to at least one remote repository per remote Tenable Security Center to re-authenticate. See Remote Repositories in the Tenable Security Center User Guide.

  • After you upgrade Tenable Security Center Director, you will need to sync existing remote repositories (either manually or via a scheduled sync) before you can browse vulnerability data from newly synced scan results.

    For more information, see Scan Results in the Tenable Security Center Director User Guide.

• API/Tooling: If you use pyTenable with the Tenable Security Center API, upgrade pyTenable to version 1.4.2 or later.

Explore Findings

Tenable Security Center 6.9.0 introduces Explore Findings, a modernized vulnerability query interface that provides expanded filtering options—including severity, asset, plugin, and IP-based filters—and surfaces VPR key driver fields directly in the findings details panel. The legacy Analysis view continues to work as-is in this release.

For more information, see Explore Findings in the Tenable Security Center User Guide.

Nessus Scanners via Sensor Proxy

Tenable Security Center 6.9.0 allows administrators to link Tenable Nessus scanners through a Sensor Proxy, enabling more flexible scanner deployments and improved horizontal scaling for large enterprise and Tenable Enclave Security environments. This extends the existing Web App Scanning→Sensor Proxy→Tenable Security Center architecture delivered in Tenable Security Center 6.5.0. Existing scan policies, zones, licensing, plugin update workflows, and direct (non-Sensor Proxy) Tenable Nessus scanner connections remain fully compatible.

For more information, see Linked Scanning Overview and Add a Linked Tenable Nessus Scanner in the Tenable Security Center User Guide.

Diagnostic Bundle Auto-Upload

Administrators can now choose to submit Tenable Security Center diagnostic files directly to Tenable Support from within the console, eliminating the need to manually download and re-upload files. A valid Tenable Nessus feed license is required to use this feature.

Windows LAPS Credential Support

Tenable Security Center now supports Windows Local Administrator Password Solution (LAPS), enabling scan credentials to be retrieved dynamically from Active Directory. A new configuration option in the UI allows administrators to specify the required LAPS parameters for authenticated scanning.

PAM Kerberos Target Authentication Support

Tenable Security Center now supports Kerberos Target Authentication for Windows and SSH credentials across all supported PAM integrations, including BeyondTrust Password Safe, Delinea Secret Server, CyberArk Vault, and others. A new option in credential settings enables Kerberos authentication and exposes the required configuration fields when activated.

FIPS 140-3 Support

Tenable Security Center upgrades to OpenSSL 3.5 and includes the OpenSSL FIPS provider, which restricts network cryptographic operations to FIPS-approved algorithms. To enable FIPS mode, go to System > Configuration > Security.

Trending Data Migration to PostgreSQL

Tenable Security Center 6.9.0 migrates trending data from the legacy file-based storage to a modern architecture. Existing trend data is preserved automatically on upgrade. This change reduces disk usage for most deployments and establishes the foundation for trending on additional data types—such as mitigated findings—in future releases.

For more information, see Trending in the Tenable Security Center User Guide.

Freeze Window Rollover Scan Control

Freeze windows now include an option to suppress automatic rollover scan creation during the freeze period. This prevents large queues of backlogged scans from accumulating after broad maintenance windows.

Performance

This release includes internal improvements that reduce latency and increase overall platform stability.

Section 508 Accessibility (Chapter 3)

Tenable Security Center 6.9.0 improves functional accessibility in the Tenable Security Center graphical user interface against the Chapter 3 Functional Performance Criteria of the Tenable Security Center VPAT.

Criteria addressed:

• 302.1 / 302.2 — Without Vision / Limited Vision: Tenable Security Center now exposes additional UI elements to screen readers without visual interaction.

• 302.3 — Without Perception of Color: Color is no longer the sole indicator of state or meaning for certain elements.

• 302.7 / 302.8 — Limited Manipulation / Limited Reach and Strength: Tenable Security Center improves keyboard navigation support and reduces simultaneous or sustained manual actions.

• 302.9 — Limited Language, Cognitive, and Learning Abilities: UI behavior is more consistent and predictable with clearer labeling.

These changes improve the conformance posture for customers subject to Section 508 reporting requirements. An updated VPAT (last revised March 2025) reflecting these changes will be available from Tenable.

Increased /tmp Space Requirement

Tenable Security Center 6.9.0 requires at least 10 GB of free space in the /tmp directory when running the RPM installer from /tmp, if /tmp is on its own partition.

For more information, see Hardware Requirements in the Tenable Security Center User Guide.

Defect ID	Bug Fix
02446864	Fixed an issue where the Publish Site could not be edited or deleted.
02452956	Fixed an issue where plugins did not display all vulnerable packages.
02442205	Resolved an issue where compliance scans returned false positive results.
02462569	Fixed an issue where configuring Hashicorp SSH credentials with sudo escalation returned a "Missing required attribute: 'pam_auth_method'" error.
02446055	Fixed an issue where selecting Scan Network Printers under Fragile Devices did not display additional configuration options.
02456476	Resolved an issue where importing scan results failed with error #11 after upgrading to Tenable Security Center 6.8.0.
02450202	Fixed an issue where authentication to remote repositories failed after upgrading to Tenable Security Center 6.8.0.
02454912	Resolved an issue where the scanner endpoint returned a null statusMessage.
02454335	Fixed an issue where creating or updating remote repository connections failed after upgrading to Tenable Security Center 6.8.0.
02435895, 02451743, 02476314	Resolved an issue where CIS compliance scan results differed between Tenable Nessus Manager and Tenable Security Center.
02450899, 02462304, 02433262, 02475863	Fixed an issue where importing scan results failed after upgrading to Tenable Security Center 6.8.0.
02438765	Resolved an issue where the detail export in Explore Assets did not function correctly.
02440810, 02465601	Fixed an issue where generating reports failed in Tenable Security Center 6.8.0.
02429249, 02455121	Resolved an issue where non-credentialed scan results were overwritten by agent scan results.
02441134, 02458445	Fixed an issue where Tenable One OT Exposure asset data did not merge correctly during synchronization.
02443842	Resolved an issue where the CyberArk Vault Kerberos switch disabled itself after being enabled.
02443063, 02467148	Fixed an issue where credentials could not be edited.
02438284, 02447881, 02441709, 02477994	Resolved a packaging defect in the Tenable Security Center 6.8.0 RPM build.
02431185, 02438492, 02453947, 02321623, 02460357, 02442476, 02478875, 02472739	Fixed an issue where old sessions were not cleared correctly in Tenable Security Center 6.8.x.
02432349	Resolved an issue where modifying VMware vCenter API credentials returned a "Missing required attribute: 'pam_auth_method'" error.
02427233, 02440295, 02440851, 02485210, 02357420	Fixed an issue where login failed after upgrading to Tenable Security Center 6.8.0 on RHEL 9.7 due to a key length error.
02431058	Resolved an issue where scan report generation failed.
02424634, 02432081, 02433967, 02440046	Fixed an issue where upgrading from Tenable Security Center 6.7.2 to 6.8.0 failed on FIPS-enabled hosts.
02420328	Resolved an issue where Tenable Web App Scanning scan scope URLs were not propagated to the scanner when using Sensor Proxy.
02416110	Fixed an issue where VMware vCenter API credential passwords could not be changed after initial configuration.
02413655	Resolved an issue where sync job imports did not complete.
02409001	Fixed an issue where assets were not displayed when searching by IPv4 address.
02410805	Resolved an issue where changes to the Tenable Web App Scanning scan partial result threshold did not take effect.
02402169, 02453355, 02463517, 02485688	Fixed an issue where scan modification permissions were lost after upgrading to Tenable Security Center 6.7.2.
02384098, 02416882, 02262222, 02433659, 02420977, 02459048	Resolved an issue where the Vulnerability Intelligence tab failed to load findings and affected asset data.
02399765	Fixed an issue where plugin diff uploads failed on offline Tenable Security Center deployments.
02398769	Resolved an issue where configuring multiple DOM exclusions caused Tenable Web App Scanning scans to crash.
02398903	Fixed an issue where users with a fully privileged custom role could not edit users assigned the Security Manager role.
02388247	Resolved an issue where vulnerabilities displayed an invalid date after records were removed through Data Expiration.
02391085	Fixed an issue where Tenable Web App Scanning scans incorrectly displayed a "Scan Import Blocked: WAS license exceeded" message.
02381559	Resolved an issue where asset tag definition filters could not be saved.
02374205, 02418567, 02407201	Fixed an issue where copying scan results across groups did not display the vulnerability summary.
02356225, 02379364, 02436241, 02463391, 02470615, 02470655, 02474292	Resolved an issue where diagnostic files could not be created from the UI or command line.
02379591	Fixed an issue where the Max Ports Reported setting in agent scan policies did not apply correctly.
02351627, 02397928	Resolved an issue where the Vulnerability Intelligence tab failed to load data.
02357488	Fixed an issue where global search showed different asset totals than the Assets IP Summary view.
02355077	Resolved an issue where SOAP API credentials could not be updated.
02331225	Fixed an issue where the "To" address field was missing from Report Template email settings.
02262221	Resolved an issue where creating a ticket displayed all vulnerabilities instead of only those associated with the selected scan.
02294654	Fixed an issue where keyword searches in the system log did not return expected results.
02239480	Resolved an issue where deleting an admin user displayed a misleading message about dependent objects.
02235054	Fixed an issue where the Apply Rules button disappeared.
02213034	Resolved an issue where Tenable Web App Scanning scans did not include Plugin 98025 (HTTP Server Authentication Succeeded).
02196297	Fixed an issue where Custom Analysis Links were not functional in legacy organizations.
02142541	Resolved an issue where the Remediation Instructions by Host report returned empty results for Top Ports and Top Services.
02104333	Fixed an issue where deleting a user resulted in a timeout error.
02006012, 01956129, 02058663, 02114082, 02354682	Resolved an issue where compliance scan results displayed incorrect output and status.
02013783, 02042641, 01767279	Fixed an issue where agent scans did not use configured variables from the UI.

• When a freeze window takes effect, scan jobs that are already running on a managed Tenable Nessus scanner continue to run until they complete. Tenable Security Center sends a stop signal when the freeze window begins, but does not terminate in-flight scans.

• During a fresh installation, the console log may display the message Error in GnuTLS initialization: Error while performing self checks. This message is cosmetic only, does not affect installation success, and has no impact on the FIPS validity of the installed system. Tenable expects to address this message in a future release.

• Explore Findings does not display all applied filters in the query bar when multiple filters are applied.

• Disabling a linked scanner from the scanner's edit page has no effect. The scanner may still display a status of initialized or working, but the scanner is disabled on the backend and does not run scans. As a workaround, remove the disabled linked scanner from the scan zone to fully disable it from scans.

• If a repository configured with a scan that uses a linked scanner connected through Sensor Proxy is deleted or becomes inaccessible, the scan policy continues to try to run instead of failing with an error. The scan reschedules automatically, approximately every 12 minutes, and displays a status of No Results.

Filenames and MD5 or SHA-256 checksums are located on the Tenable Security Center Downloads page page.

The following table lists the Tenable product versions tested with Tenable Security Center 6.9.0.

Product	Tested Version
Tenable Nessus	10.8.0 and later
Tenable One OT Exposure	3.19.0 and later
Tenable Network Monitor	6.5.0 and later

For information about EOL dates and policies for Tenable products, see the Tenable Software Release Lifecycle Matrix and Policy.

Apply the patch to a standalone Tenable Security Center or Tenable Core + Tenable Security Center:

1. Download the patch from the Tenable Security Center Downloads page to Tenable Security Center. You can save the files in any location (for example, /tmp).

2. Access the command line as a user with root-level permissions.

3. Run the following command to untar the patch file, where [patch file name] is the name of the .tgz patch file you downloaded:

   tar zxf [patch file name]

4. Run the following command to change the directory to the extracted directory, where [directory] is the extracted directory:

   cd [directory]

5. Run the following command to begin the installation:

   sh ./install.sh

   The installation begins and Tenable Security Center stops.

6. After the installation finishes, you must restart Tenable Security Center.

What to do next:

• (Optional) Confirm the patch successfully applied to Tenable Security Center, as described in the knowledge base article.

All versions:

• install.sh

• httpd

• openssl

• php

• pg_ctl

• postgres

• psql

Tenable Security Center 6.7.x and 6.8.0 only:

• redis-server

• sc-asset-svc

• showvulnsv2-linux-amd64

Tenable Security Center 6.8.0 only:

• sc-enc-linux-amd64

Filenames and MD5 or SHA-256 checksums are located on the Tenable Security Center Downloads page.

Apply the patch to a standalone Tenable Security Center or Tenable Core + Tenable Security Center:

1. Download the patch from the Tenable Security Center Downloads page to Tenable Security Center. You can save the files in any location (for example, /tmp).

2. Access the command line as a user with root-level permissions.

3. Run the following command to untar the patch file, where [patch file name] is the name of the .tgz patch file you downloaded:

   tar zxf [patch file name]

4. Run the following command to change the directory to the extracted directory, where [directory] is the extracted directory:

   cd [directory]

5. Run the following command to begin the installation:

   sh ./install.sh

   The installation begins and Tenable Security Center stops.

6. After the installation finishes, you must restart Tenable Security Center.

What to do next:

• (Optional) Confirm the patch successfully applied to Tenable Security Center, as described in the knowledge base article.

• install.sh

• pg_ctl

• postgres

• psql

Filenames and MD5 or SHA-256 checksums are located on the Tenable Security Center Downloads page.

Apply the patch to a standalone Tenable Security Center or Tenable Core + Tenable Security Center:

1. Download the patch from the Tenable Security Center Downloads page to Tenable Security Center. You can save the files in any location (for example, /tmp).

2. Access the command line as a user with root-level permissions.

3. Run the following command to untar the patch file, where [patch file name] is the name of the .tgz patch file you downloaded:

   tar zxf [patch file name]

4. Run the following command to change the directory to the extracted directory, where [directory] is the extracted directory:

   cd [directory]

5. Run the following command to begin the installation:

   sh ./install.sh

   The installation begins and Tenable Security Center stops.

6. After the installation finishes, you must restart Tenable Security Center.

What to do next:

• (Optional) Confirm the patch successfully applied to Tenable Security Center, as described in the knowledge base article.

• install.sh

• FeedUpdateTool.php

Filenames and MD5 or SHA-256 checksums are located on the Tenable Security Center Downloads page.

Compatibility and Requirements

• Version Support: Tenable Security Center 6.8.0 supports direct upgrades from version 6.4.0 and later on the same operating system. If your upgrade skips versions (for example, 6.6.0 to 6.8.0), review the release notes for all skipped versions to identify necessary configuration updates.

• Hardware: Tenable Security Center has updated hardware specifications as of version 6.7.0. While the upgrade does not block systems that fall below these specs, performance may degrade. Tenable Support may require hardware upgrades to resolve support cases.

  For more information, see Hardware Requirements in the Tenable Security Center Director User Guide.

• Deprecations:

  • Kubernetes: support ended in version 6.6.0. When you upgrade Tenable Security Center, you must migrate to Tenable Enclave Security.

  • Web App Scanning using Tenable Nessus was deprecated in version 6.7.0. When you upgrade Tenable Security Center, you must move to Tenable Core or Docker-based scanners.

Pre-Upgrade Preparation

• Backups: Perform a backup before upgrading Tenable Security Center. For more information, see Perform a Backup in the Tenable Security Center User Guide.

• External PostgreSQL:

  • If you have an external PostgreSQL database, it must be running and reachable before you upgrade Tenable Security Center. Failure to do so will result in a failed upgrade of Tenable Security Center, even if the upgrade appears to succeed. If this occurs, you can restore the database with a preexisting backup file. Otherwise, you will need to contact your customer support representative to resolve the issue.

  • If you want to run a VACUUM operation in an external PostgreSQL, you must have super user or table owner permissions.

• Tenable Nessus Plugins: Verify that your Tenable Nessus plugins have been updated within the last 30 days.

During Upgrade

• Upgrade Duration: Upgrades from version 6.6.x or earlier with large datasets may take several hours.

• Tenable Security Center Director: If you upgrade Tenable Security Center Director, upgrade all managed instances connected to Tenable Security Center Director. After upgrading, allow up to 15 minutes for your managed Tenable Security Center instances to sync with Tenable Security Center Director.

• Tiered Setups: When you upgrade to Tenable Security Center 6.8.0 with a tiered setup using remote or offline universal repositories, follow these steps:

  1. In the parent Tenable Security Center console, change the update frequency of each remote repository to Never.

     Note: Record the existing frequency (the default is Daily) before you change it.

  2. Upgrade the child and parent Tenable Security Center consoles that synchronize repositories to version 6.8.0.

  3. From the parent Tenable Security Center console, initiate a synchronization of the repositories.

     Caution: The initial repository synchronization after you upgrade to 6.8.0 requires re-authentication. You must provide administrator login credentials or perform a manual key exchange.

  4. Verify the synchronization completes successfully and ensure the parent console displays the updated data.

  5. In the parent Tenable Security Center console, change the update frequency of each remote repository back to your previous setting (for example, Daily).

  For more information, see the Knowledge Base article.

• Offline Universal Repositories: Tenable Security Center 6.7.0 fixed an issue where DNS assets were broken for offline universal repositories, because you could not enter the IP range when adding the repository. When you upgrade Tenable Security Center from 6.6.x or earlier, the IP range for the offline universal repository is not automatically set. You must manually edit the offline repository and enter the IP range to use DNS assets.

Post-Upgrade and Maintenance

• Search and Vulnerability Intelligence: The feed update must complete successfully to enable Search and Vulnerability Intelligence. After you upgrade Tenable Security Center, verify the status of the feed update. If you cannot confirm that an automatic update occurred, manually trigger a feed update.

• Remote Repository Sync:

  • Enabling FIPS 140-2 on Oracle 8, RHEL 8, or Tenable Core requires re-authentication of Remote Repository Syncs.

    1. Download the RSA key from the Tenable Security Center host console: cat /opt/sc/.ssh/id_rsa.pub

    2. Upload the key to each remote Tenable Security Center. See Add a Key in the Tenable Security Center User Guide.

    3. Navigate to at least one remote repository per remote Tenable Security Center to re-authenticate. See Remote Repositories in the Tenable Security Center User Guide.

  • After you upgrade Tenable Security Center Director, you will need to sync existing remote repositories (either manually or via a scheduled sync) before you can browse vulnerability data from newly synced scan results.

    For more information, see Scan Results in the Tenable Security Center Director User Guide.

• API/Tooling: If you use pyTenable with the Tenable Security Center API, upgrade pyTenable to version 1.4.2 or later.

Asset Repositories

When you upgrade to Tenable Security Center 6.8.0, all IPv4, IPv6, Agent, and Universal repositories become Asset repositories. This change consolidates the functionality of previous repository types into a single type. You can now target any data—including agent, network scan, and passive data—into any repository.

For more information, see Asset Repositories in the Tenable Security Center User Guide.

Explore Assets Additions

The Explore Assets page includes new Group By options:

• Microsoft ID

• Network

• System Type

• Asset Criticality Rating (ACR) (Available in Tenable Security Center+)

Other enhancements to the Explore Assets page include:

• You can edit Asset Criticality Rating (ACR) scores directly in the Explore interface. This feature is available in Tenable Security Center+.

• You can export findings and installed software for specific assets to a comma-separated values (CSV) file.

Scan Per-Host Timeout

In advanced scan policies, you can configure a timeout for each host to prevent a single host from increasing the overall scan time.

VPR Enhancements

The updated TenableVulnerability Priority Rating (VPR) is available in the Vulnerability Intelligence and CVE Search sections of Tenable Security Center.

These updates provide the following functionality:

• Refined Risk Calculation: While the Common Vulnerability Scoring System (CVSS) classifies approximately 60% of Common Vulnerabilities and Exposures (CVE) as High or Critical, our original VPR reduced this to 3%. The enhanced VPR further refines this, helping your teams focus on just 1.6% of vulnerabilities that represent actual risk to your business by leveraging an even broader spectrum of threat intelligence and real-time data input used to predict near-term exploitation.

• AI-Driven Insights: Large Language Model (LLM) insights provide information on why an exposure is significant, how threat actors weaponize the exposure, and guidance for mitigation. For more information, see Vulnerability Intelligence in the Tenable Security Center User Guide.

• Industry and Regional Context: New metadata identifies if threat actors are targeting a vulnerability within a specific industry or geographic region.

The original VPR and the enhanced VPR (Beta) scores coexist in Tenable Security Center. Tenable will provide advance notice before the original VPR is deprecated.

See the FAQ and whitepaper for additional information.

Explore Assets Performance Enhancements

Tenable improved the performance of the Explore Assets page. You can now leave the page while Tenable Security Center processes long-running queries. The query completes in the background. If you re-run the filter within 30 minutes, the results are available immediately.

Additionally, Tenable Security Center now uses caching for several datasets to improve performance.

Postgres Password Encryption for External Databases

Tenable Security Center supports at-rest encryption for External PostgreSQL connection configurations.

For more information, see External PostgreSQL with Tenable Security Center in the Tenable Security Center User Guide.

Privileged Access Management Integrations

• The Delinea Secret Server auto-discovery feature removes the requirement to manually add specific targets to a scan. For more information on support and configuration, see the Delinea Integration Guide.

• The Delinea integration includes a new API authentication method called Delinea Authentication Method, which allows you to use an API key. Tenable also removed the Checkout Duration field because the integration did not use it.

• BeyondTrust Password Safe and Delinea integrations now support retrieval of database credentials from the safe.

• The CyberArk Vault integration includes new options for querying credentials. You can retrieve login credentials with advanced parameters by selecting Get credential by > Parameters, or you can configure a single credential to fetch each password separately by username. A Get Escalation Credential By option is available for escalation credentials. The Escalation Account Name field is no longer required.

Defect ID	Bug Fix
01683034	Fixed an issue where scans failed to execute if they were associated with deprecated audit files, ensuring continuous scan operations.
02134273	Updated the analysis endpoint API documentation to correctly reflect deprecated query ID versions, improving clarity for developers using the Tenable Security Center API.
02155054	Resolved an issue where SMTP configurations returned errors despite having valid settings, ensuring reliable email notification delivery.
02158649	Improved asset identification by using device types from plugins when ACR does not detect a system type, ensuring the "General Purpose" status updates correctly in Host Assets.
02183280	Fixed a filtering issue that prevented certain audit file checks from appearing in dashboard components, improving the accuracy of CIS control reporting.
02210079	Resolved a PostgreSQL error related to index row size limits in Tenable Security Center 6.5.1, improving database stability and performance.
02224527	Fixed an issue where disabling specific plugins in an agent scan policy resulted in incorrect plugin counts and unexpected scan results, ensuring policies are enforced accurately.
02226497	Resolved an issue in Vulnerability Intelligence where searching by CVE ID failed to display affected assets, restoring visibility into specific vulnerabilities.
02243738	Fixed a bug that prevented the deletion of specific user accounts after they were moved between groups, streamlining user management.
02261416, 02281157, 02311196, 02342406, 02345555	Resolved an import error (code #255) that occurred when processing large scan results in Tenable Security Center 6.6, ensuring successful data ingestion for high-volume scans.
02263327	Addressed a permission vulnerability where unprivileged users could export CSV reports containing user lists, strengthening organizational data security.
02288287	Fixed a frequent JavaScript type error in Tenable Security Center 6.5.1 that impacted user interface stability.
02289644, 02357581	Resolved an issue where running discovery and vulnerability scans against the same hosts created duplicate IP entries in the Universal Repository, ensuring cleaner asset data.
02298002	Fixed a bug in advanced agent scan policies where filtering plugins by "VPR = NONE" triggered an error, allowing for more precise scan configurations.
02300062, 02341628, 02346929, 02317723	Resolved an issue causing agent scans to fail with a '404' error, ensuring consistent communication between agents and the console.
02300192	Fixed an issue in Vulnerability Intelligence where irrelevant plugins were incorrectly associated with specific CVEs, improving the accuracy of vulnerability data.
02312776, 02321459	Improved agent scan remediation logic to ensure dependent plugins are correctly mitigated in Tenable Security Center when software is uninstalled.
02315148	Resolved a PHP error in GroupLib.php that caused excessively large error logs, reducing unnecessary disk space consumption.
02324859, 02372515, 02381015, 02383992, 02378255, 02393908, 02398497, 02400214, 02402449, 02405896, 02413903, 02370468, 02409870, 02417581	Fixed an issue preventing successful feed updates on CentOS Stream 9 for Tenable Security Center 6.6.0, ensuring users receive the latest vulnerability definitions.
02330615	Optimized database logging to prevent excessive IO traffic and the generation of massive log files, improving system performance and storage efficiency.
02346421, 02348865, 02351080, 02373640, 02372397, 02381214, 02385989, 02385875, 02383010, 02388580, 02391203, 02395661, 02397073, 02374457, 02401052, 02418124	Resolved an issue where users were automatically logged out when accessing the Explore Assets menu after an upgrade to Tenable Security Center 6.7.
02352990, 02406324	Fixed a bug that prevented users from modifying CyberArk credentials in Tenable Security Center, ensuring credentialed scans can be maintained.
02361808	Resolved a backend timeout issue that caused policy creation to fail and result in broken policy icons, ensuring reliable scan configuration.
02367457	Fixed a database synchronization issue following upgrades to Tenable Security Center 6.7.1 that caused job queue failures and notification errors.
02367672	Resolved a critical licensing error that prevented users from applying valid Tenable Nessus activation codes, ensuring uninterrupted product access.
02372395	Fixed an issue where saving SSH CyberArk Vault credentials would overwrite the escalation account name with "SET," preventing scan failures due to credential corruption.
02376239	Corrected a discrepancy between Vulnerability Intelligence and Vulnerability Analysis views to accurately reflect the mitigated status of assets for specific CVEs.
02383778	Updated the software parsing logic for Alma Linux 9.1 to ensure installed software is correctly displayed in the Host Assets view.

Filenames and MD5 or SHA-256 checksums are located on the Tenable Security Center Downloads page page.

The following table lists the Tenable product versions tested with Tenable Security Center 6.8.0.

Product	Tested Version
Tenable Nessus	10.8.0 and later
Tenable One OT Exposure	3.19.0 and later
Tenable Network Monitor	6.5.0 and later

For information about EOL dates and policies for Tenable products, see the Tenable Software Release Lifecycle Matrix and Policy.

Apply the patch to a standalone Tenable Security Center or Tenable Core + Tenable Security Center:

1. Download the patch from the Tenable Security Center Downloads page to Tenable Security Center. You can save the files in any location (for example, /tmp).

2. Access the command line as a user with root-level permissions.

3. Run the following command to untar the patch file, where [patch file name] is the name of the .tgz patch file you downloaded:

   tar zxf [patch file name]

4. Run the following command to change the directory to the extracted directory, where [directory] is the extracted directory:

   cd [directory]

5. Run the following command to begin the installation:

   sh ./install.sh

   The installation begins and Tenable Security Center stops.

6. After the installation finishes, you must restart Tenable Security Center.

What to do next:

• (Optional) Confirm the patch successfully applied to Tenable Security Center, as described in the knowledge base article.

Apply the patch to a Tenable Security Center running on Tenable Enclave Security:

1. Download the patch from the Tenable Security Center Downloads page to Tenable Security Center. You can save the files in any location (for example, /tmp).

2. Copy the patch file to the Tenable Security Center pod of your namespace, where [patch file name] is the name of the .tgz patch file you downloaded:

   kubectl cp [patch file name] [namespace]/[sc-pod]:[patch file name]

3. Log in to the Tenable Enclave Security runtime container with the following command:

   kubectl exec -it tenable-security-center-0 -n [namespace] -- /bin/sh

4. Run the following command to untar the patch file:

   tar zxf [patch file name]

5. Run the following command to change the directory to the extracted directory, where [directory] is the extracted directory:

   cd [directory]

6. Stop the Tenable Security Center service with the following command:

   /scbase/SC.sh stop

7. Run the following command to begin the installation:

   sh ./install.sh

8. Start Tenable Security Center with the following command:

   /scbase/SC.sh start

9. After the installation finishes, Tenable Security Center automatically restarts. You may be logged out of the Tenable Security Center pod after you apply the patch.

• install.sh

• Utility.php

• VulnLib.php

Filenames and MD5 or SHA-256 checksums are located on the Tenable Security Center Downloads page.

Apply the patch to a standalone Tenable Security Center or Tenable Core + Tenable Security Center:

1. Download the patch from the Tenable Security Center Downloads page to Tenable Security Center. You can save the files in any location (for example, /tmp).

2. Access the command line as a user with root-level permissions.

3. Run the following command to untar the patch file, where [patch file name] is the name of the .tgz patch file you downloaded:

   tar zxf [patch file name]

4. Run the following command to change the directory to the extracted directory, where [directory] is the extracted directory:

   cd [directory]

5. Run the following command to begin the installation:

   sh ./install.sh

   The installation begins and Tenable Security Center stops.

6. After the installation finishes, you must restart Tenable Security Center.

What to do next:

• (Optional) Confirm the patch successfully applied to Tenable Security Center, as described in the knowledge base article.

Apply the patch to a Tenable Security Center running on Tenable Enclave Security:

1. Download the patch from the Tenable Security Center Downloads page to Tenable Security Center. You can save the files in any location (for example, /tmp).

2. Copy the patch file to the Tenable Security Center pod of your namespace, where [patch file name] is the name of the .tgz patch file you downloaded:

   kubectl cp [patch file name] [namespace]/[sc-pod]:[patch file name]

3. Log in to the Tenable Enclave Security runtime container with the following command:

   kubectl exec -it tenable-security-center-0 -n [namespace] -- /bin/sh

4. Run the following command to untar the patch file:

   tar zxf [patch file name]

5. Run the following command to change the directory to the extracted directory, where [directory] is the extracted directory:

   cd [directory]

6. Stop the Tenable Security Center service with the following command:

   /scbase/SC.sh stop

7. Run the following command to begin the installation:

   sh ./install.sh

8. Start Tenable Security Center with the following command:

   /scbase/SC.sh start

9. After the installation finishes, Tenable Security Center automatically restarts. You may be logged out of the Tenable Security Center pod after you apply the patch.

• install.sh

• httpd

• php

• apr.exp

• aprutil.exp

• libapr-1.a

• libapr-1.la

• libapr-1.so.0.7.5

• libaprutil-1.a

• libaprutil-1.la

• libaprutil-1.so.0.6.3

• libcrypto.a

• libcrypto.so

• libcrypto.so.3

• libcurl.a

• libcurl.la

• libcurl.so.4.8.0

• libssl.so

• libssl.so.3

Filenames and MD5 or SHA-256 checksums are located on the Tenable Security Center Downloads page.

Apply the patch to a standalone Tenable Security Center or Tenable Core + Tenable Security Center:

1. Download the patch from the Tenable Security Center Downloads page to Tenable Security Center. You can save the files in any location (for example, /tmp).

2. Access the command line as a user with root-level permissions.

3. Run the following command to untar the patch file, where [patch file name] is the name of the .tgz patch file you downloaded:

   tar zxf [patch file name]

4. Run the following command to change the directory to the extracted directory, where [directory] is the extracted directory:

   cd [directory]

5. Run the following command to begin the installation:

   sh ./install.sh

   The installation begins and Tenable Security Center stops.

6. After the installation finishes, you must restart Tenable Security Center.

What to do next:

• (Optional) Confirm the patch successfully applied to Tenable Security Center, as described in the knowledge base article.

Apply the patch to a Tenable Security Center running on Tenable Enclave Security:

1. Download the patch from the Tenable Security Center Downloads page to Tenable Security Center. You can save the files in any location (for example, /tmp).

2. Copy the patch file to the Tenable Security Center pod of your namespace, where [patch file name] is the name of the .tgz patch file you downloaded:

   kubectl cp [patch file name] [namespace]/[sc-pod]:[patch file name]

3. Log in to the Tenable Enclave Security runtime container with the following command:

   kubectl exec -it tenable-security-center-0 -n [namespace] -- /bin/sh

4. Run the following command to untar the patch file:

   tar zxf [patch file name]

5. Run the following command to change the directory to the extracted directory, where [directory] is the extracted directory:

   cd [directory]

6. Stop the Tenable Security Center service with the following command:

   /scbase/SC.sh stop

7. Run the following command to begin the installation:

   sh ./install.sh

8. Start Tenable Security Center with the following command:

   /scbase/SC.sh start

9. After the installation finishes, Tenable Security Center automatically restarts. You may be logged out of the Tenable Security Center pod after you apply the patch.

• install.sh

• updateMemoryLimits.sh

Filenames and MD5 or SHA-256 checksums are located on the Tenable Security Center Downloads page.