Description Summary:
Tenable Terrascan contains vulnerabilities involving server-side request forgery (SSRF) and improper file path handling, potentially leading to unauthorized resource access.

Executive Summary:
Tenable Terrascan versions up to 1.18.3 are vulnerable to SSRF and file path injection, which could allow attackers to access sensitive internal resources.

Vulnerability Details

CVE-ID: CVE-2026-47358

Affected Software: Tenable Terrascan

Affected Versions: 0 through 1.18.3

Vulnerability: This vulnerability involves multiple flaws, including Server-Side Request Forgery (CWE-918) and external control of file paths (CWE-73). These issues allow an unauthenticated attacker to induce the application to make unauthorized requests or access files in unauthorized spheres.

Business Impact

The ability to perform SSRF and manipulate file paths provides an attacker with a vector to probe internal networks, bypass firewalls, and potentially read sensitive configuration files or cloud metadata. With a CVSS score of 7.5 (High), this represents a critical risk to the security boundary of any environment utilizing Terrascan for infrastructure-as-code scanning.

Remediation Plan

Immediate Action: Review vendor guidance and apply available security updates for Terrascan. If no patch is currently available, restrict access to the service to authorized users only.

Proactive Monitoring: Review application logs for suspicious outbound requests to internal endpoints or unusual file access attempts originating from the Terrascan service.

Compensating Controls: Implement strict egress filtering on the host running Terrascan to prevent unauthorized connections to sensitive internal or cloud metadata services.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly automatable, which increases the necessity for proactive defense.

Analyst Recommendation

Given the potential for unauthorized access to internal resources, organizations should treat this vulnerability with high priority. Monitor Tenable’s official advisory channels and apply the recommended version update as soon as it becomes available.

Description Summary:
Tenable Terrascan is affected by multiple vulnerabilities, including SSRF and improper file path control, which may allow unauthorized resource interactions.

Executive Summary:
Tenable Terrascan versions up to 1.18.3 contain SSRF and path manipulation flaws that could permit an attacker to interact with restricted internal resources.

Vulnerability Details

CVE-ID: CVE-2026-47357

Affected Software: Tenable Terrascan

Affected Versions: 0 through 1.18.3

Vulnerability: The application is susceptible to Server-Side Request Forgery (CWE-918) and external control of file names or paths (CWE-73). These vulnerabilities allow an unauthenticated attacker to manipulate how the application interacts with external and internal resources.

Business Impact

Exploitation of these flaws could lead to unauthorized access to internal services or sensitive file reading, undermining the security of the infrastructure analysis process. With a CVSS score of 7.5 (High), this vulnerability poses a substantial threat to the confidentiality and security of the environments where Terrascan is deployed.

Remediation Plan

Immediate Action: Update Terrascan to the latest version as soon as the vendor releases a patch. In the interim, ensure the application is deployed in a hardened environment with minimal network privileges.

Proactive Monitoring: Use network monitoring tools to detect and block unauthorized or anomalous outbound traffic from the Terrascan service.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network security policy to restrict the application's ability to reach internal or private network resources.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of these flaws makes them attractive targets for automated scanning, necessitating swift defensive action.

Analyst Recommendation

Organizations should prioritize the remediation of this vulnerability due to its high impact and potential for exploitation. Monitor for official vendor updates and apply them immediately upon release to secure the Terrascan implementation.

Description Summary:
Tenable Terrascan versions 0 through 1.18.3 are vulnerable to a Server-Side Request Forgery (SSRF) flaw, allowing unauthenticated attackers to interact with internal network resources.

Executive Summary:
A critical Server-Side Request Forgery (SSRF) vulnerability in Tenable Terrascan allows unauthenticated remote attackers to potentially access internal services or sensitive metadata.

Vulnerability Details

CVE-ID: CVE-2026-47356

Affected Software: Tenable Terrascan

Affected Versions: 0 through 1.18.3

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that occurs due to improper input validation, allowing an unauthenticated remote attacker to force the application to send arbitrary requests to internal or external systems.

Business Impact

The vulnerability carries a CVSS score of 7.5, indicating a high level of risk to organizational infrastructure. Successful exploitation could allow an attacker to bypass firewalls, access internal administrative interfaces, or exfiltrate sensitive cloud metadata, leading to significant unauthorized access or lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to the latest version of Terrascan to patch the SSRF vulnerability.

Proactive Monitoring: Review application and network egress logs for unusual connection attempts originating from the server hosting Terrascan to internal IP addresses.

Compensating Controls: Implement strict egress filtering on the host machine to prevent the application from making unauthorized outbound connections to internal subnets.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly exploitable as it does not require authentication and is automatable.

Analyst Recommendation

Given the potential for internal network reconnaissance and service exploitation, organizations using Terrascan should prioritize updating to the latest secure version. Immediate patching is the most effective way to eliminate the risk associated with this SSRF vulnerability.

Description Summary:
A command injection vulnerability in Tenable Security Center allows an authenticated remote attacker to execute arbitrary code on the underlying server.

Executive Summary:
Tenable Security Center is vulnerable to a critical command injection flaw that allows authenticated remote attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-2630

Affected Software: Tenable Security Center

Affected Versions: Tenable Security Center: 0 through 6.7.2

Vulnerability: This vulnerability is an OS command injection (CWE-78) flaw that occurs due to improper neutralization of special elements in commands. It requires the attacker to have low-level authenticated access to the application.

Business Impact

The ability for an attacker to execute arbitrary code on the host server presents a severe risk of full system compromise. Given the CVSS score of 8.8, this vulnerability is classified as High severity, as it could lead to unauthorized data access, lateral movement within the network, or complete control over the security management infrastructure.

Remediation Plan

Immediate Action: Administrators must apply the Tenable Security Center Patch SC-202602.2 available through the Tenable Downloads Portal.

Proactive Monitoring: Security teams should review system access logs for suspicious command executions and monitor for unusual service account behavior originating from the Security Center host.

Compensating Controls: Ensure that the Tenable Security Center instance is isolated within a restricted network segment and that access is strictly limited to authorized personnel to reduce the likelihood of malicious exploitation by authenticated users.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of February 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the potential for remote code execution makes it a high-priority item for patching.

Analyst Recommendation

The risk of remote code execution within a security management platform like Tenable Security Center necessitates immediate attention. Organizations should verify their current version and apply the vendor-provided patch without delay to prevent potential system-wide compromise.

Description Summary:
A command injection vulnerability exists in Tenable Security Center, allowing remote authenticated attackers to execute arbitrary system commands via an insecurely handled input parameter.

Executive Summary:
A critical command injection vulnerability in Tenable Security Center allows authenticated attackers to execute arbitrary system commands with service account privileges.

Vulnerability Details

CVE-ID: CVE-2026-19682

Affected Software: Tenable Security Center

Affected Versions: 0 up to (excluding) 6.9.0

Vulnerability: The software fails to properly neutralize special elements used in an operating system command. This flaw allows a remote attacker with low-level privileges to inject malicious commands that execute with the permissions of the underlying service account.

Business Impact

Successful exploitation of this vulnerability leads to full system compromise, as the attacker can run arbitrary commands with the privileges of the service account. Given the CVSS score of 9.9, this represents a critical risk to the confidentiality, integrity, and availability of the Tenable platform and any data managed by it. Unauthorized access could lead to lateral movement within the network or the exfiltration of sensitive vulnerability assessment data.

Remediation Plan

Immediate Action: Upgrade Tenable Security Center to version 6.9.0 or later immediately. Installation files are available through the official Tenable Downloads Portal.

Proactive Monitoring: Review system logs for suspicious process execution, particularly those originating from the Security Center service user. Monitor for unauthorized changes to system configuration files or unexpected outbound network traffic.

Compensating Controls: Implement strict network segmentation to limit access to the Security Center management interface to authorized administrative segments only. Utilize host-based intrusion detection systems to flag unauthorized command-line activity.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for total system impact via command injection.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention from security teams. Organizations should prioritize the upgrade to version 6.9.0 to eliminate the command injection vector and prevent potential compromise of the management infrastructure.

Description Summary:
An authenticated command injection vulnerability exists in Tenable Security Center during file upload processing, allowing arbitrary command execution.

Executive Summary:
An authenticated command injection vulnerability in Tenable Security Center allows an attacker to execute arbitrary commands on the underlying operating system, posing a severe risk to infrastructure security.

Vulnerability Details

CVE-ID: CVE-2026-19681

Affected Software: Tenable Security Center

Affected Versions: 0 up to (excluding) 6.9.0

Vulnerability: This is a command injection vulnerability (CWE-78) triggered during file upload processes. An authenticated user can supply malicious input that is improperly neutralized, resulting in OS command execution.

Business Impact

With a CVSS score of 9.9, successful exploitation allows an attacker to gain full control over the server hosting Security Center. This could result in the compromise of sensitive vulnerability data, lateral movement within the network, and total loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update Tenable Security Center to version 6.9.0 or later using the files provided in the Tenable Downloads Portal.

Proactive Monitoring: Monitor system logs for unexpected child processes or unusual file activity originating from the Security Center service.

Compensating Controls: Ensure that the Security Center instance is isolated via network controls and strictly limit the number of users with upload privileges.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authentication reduces the attack surface but does not mitigate the high-impact nature of the flaw.

Analyst Recommendation

Organizations utilizing Tenable Security Center must prioritize upgrading to version 6.9.0 immediately. Given the high severity and the potential for full system compromise, this should be handled as an emergency maintenance task.

Description Summary:
A SQL injection vulnerability in Tenable Security Center allows an authenticated attacker to access unauthorized database information.

Executive Summary:
A critical SQL injection vulnerability in Tenable Security Center could allow an authenticated attacker to exfiltrate sensitive data from the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-19680

Affected Software: Tenable Security Center

Affected Versions: 0 up to (excluding) 6.9.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) arising from the improper neutralization of special elements in SQL commands. The CVSS vector indicates that this flaw requires low privileges (PR:L) to execute, meaning an authenticated user can perform unauthorized database queries.

Business Impact

Successful exploitation of this vulnerability could lead to significant data compromise, as an attacker may gain unauthorized access to sensitive information stored within the Security Center database. With a CVSS score of 7.1, this flaw is categorized as High severity, necessitating prompt remediation to prevent potential data breaches and maintain the integrity of security management infrastructure.

Remediation Plan

Immediate Action: Upgrade to Tenable Security Center version 6.9.0 or later, which is available via the Tenable Downloads Portal.

Proactive Monitoring: Review database access logs for unusual query patterns or unexpected SQL syntax that may indicate automated injection attempts.

Compensating Controls: Implement Web Application Firewall (WAF) rules designed to detect and block common SQL injection payloads targeted at the application interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for direct database interaction through the application layer.

Analyst Recommendation

Given the potential for unauthorized data access, administrators should prioritize updating to version 6.9.0. Applying this patch is the only definitive way to neutralize the vulnerability and prevent exploitation by malicious actors.

Description Summary:
Tenable Security Center is vulnerable to OS command injection due to insufficient sanitization of filenames during file upload operations.

Executive Summary:
An authenticated OS command injection vulnerability in Tenable Security Center allows attackers to execute arbitrary system commands via crafted file uploads.

Vulnerability Details

CVE-ID: CVE-2026-19679

Affected Software: Tenable Security Center

Affected Versions: 0 up to (excluding) 6.9.0

Vulnerability: This vulnerability (CWE-78) occurs when the application fails to properly neutralize special characters in file upload requests. An authenticated user can leverage this weakness to inject and execute system-level commands on the Tenable Security Center appliance.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for total system impact. Unauthorized command execution could allow an attacker to gain full control over the Tenable Security Center instance, potentially leading to the theft of sensitive vulnerability data or the compromise of administrative credentials used to manage the security infrastructure.

Remediation Plan

Immediate Action: Upgrade to Tenable Security Center version 6.9.0 or later, which is officially released to mitigate this specific command injection vulnerability.

Proactive Monitoring: Review audit logs for suspicious file upload activity and monitor for unexpected spawned processes or shell commands originating from the web server user account.

Compensating Controls: Restrict access to the file upload functionality to trusted administrators only and employ WAF rules to sanitize or block uploads containing suspicious shell metacharacters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly accessible to any user with legitimate upload permissions, making it a critical target for internal or compromised-account threats.

Analyst Recommendation

Tenable Security Center is a critical component of security operations, making this vulnerability particularly sensitive. Organizations must prioritize the update to version 6.9.0 to protect their vulnerability management environment from potential exploitation.

Description Summary:
Tenable Security Center contains an OS command injection vulnerability, allowing authenticated local users to execute arbitrary commands with elevated privileges.

Executive Summary:
A local OS command injection vulnerability in Tenable Security Center could allow an authenticated attacker to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-19635

Affected Software: Tenable Security Center

Affected Versions: Versions prior to 6.9.0

Vulnerability: The software fails to properly neutralize special elements used in OS commands (CWE-78), enabling command injection. The attack requires local access and authenticated privileges (PR:L) to execute the malicious payload.

Business Impact

With a CVSS score of 8.8, this local privilege escalation vulnerability poses a severe threat to infrastructure security. An attacker who has already gained low-level access to the host can escalate their privileges to perform unauthorized system operations, leading to potential data exfiltration or system destruction.

Remediation Plan

Immediate Action: Upgrade Tenable Security Center to version 6.9.0 or later using the files provided in the Tenable Downloads Portal.

Proactive Monitoring: Monitor system logs for unexpected process execution or shell commands originating from the Security Center service account.

Compensating Controls: Restrict local shell access to the host server and apply the principle of least privilege to all users who have access to the Security Center interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for local access mitigates the risk from remote actors, but it remains a critical issue for insider threat scenarios.

Analyst Recommendation

Organizations should proceed with the update to version 6.9.0 as soon as possible. Because this is a local privilege escalation, securing the underlying operating system and auditing user access rights should be conducted alongside the software patch.

Description Summary:
Tenable Security Center contains a privilege escalation flaw allowing users with Security Manager roles to modify users outside their assigned groups.

Executive Summary:
A privilege escalation vulnerability in Tenable Security Center allows authenticated users to bypass authorization controls and modify user accounts across restricted groups.

Vulnerability Details

CVE-ID: CVE-2026-19629

Affected Software: Tenable Security Center

Affected Versions: Tenable, Inc. Security Center: 0 up to (excluding) 6.9.0

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) where a user with the Security Manager role and limited group management permissions can escalate their privileges to perform unauthorized administrative actions on users in other groups.

Business Impact

This flaw allows a malicious insider or a compromised account to expand their influence within the security management platform. With a CVSS score of 8.1, this represents a significant risk to internal governance and the principle of least privilege, as unauthorized users could potentially modify or disable security audit accounts.

Remediation Plan

Immediate Action: Upgrade Tenable Security Center to version 6.9.0 or later by downloading the update from the Tenable Downloads Portal.

Proactive Monitoring: Audit user activity logs for unexpected modifications to administrative accounts or changes to group membership configurations.

Compensating Controls: Strictly enforce the principle of least privilege by auditing existing user roles and removing unnecessary "manage user" permissions until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires low-level authenticated access, the ability to manipulate other user accounts makes it a critical internal security risk.

Analyst Recommendation

Organizations should treat this privilege escalation vulnerability with high urgency. Administrators must apply the version 6.9.0 update as soon as possible to restore proper authorization boundaries and prevent unauthorized access to sensitive security management functions.

Description Summary:
Tenable Security Center versions prior to 6.9.0 contain an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands on the underlying host.

Executive Summary:
A command injection vulnerability in Tenable Security Center prior to version 6.9.0 allows authenticated users with high privileges to execute arbitrary OS commands.

Vulnerability Details

CVE-ID: CVE-2026-19628

Affected Software: Tenable Security Center

Affected Versions: 0 up to 6.9.0

Vulnerability: The application is susceptible to OS command injection (CWE-78) due to improper neutralization of special elements. This vulnerability requires the attacker to be authenticated with high privileges, limiting the initial vector of attack to compromised or malicious administrative accounts.

Business Impact

Successful exploitation grants an attacker full control over the underlying operating system of the Security Center instance. With a CVSS score of 7.2, the potential for total system compromise, exfiltration of vulnerability data, or pivoting into the wider network environment poses a severe risk to organizational security.

Remediation Plan

Immediate Action: Update Tenable Security Center to version 6.9.0 or later immediately. The update can be obtained through the official Tenable Downloads Portal.

Proactive Monitoring: Review administrative audit logs for unusual command execution patterns or unauthorized changes to system configurations.

Compensating Controls: Ensure that administrative access to the Security Center interface is restricted to highly trusted personnel and monitored via multi-factor authentication.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for high privileges mitigates the risk of external mass exploitation, but the impact remains critical for internal security.

Analyst Recommendation

Organizations should treat this as a high-priority update. Apply the 6.9.0 patch immediately to eliminate the risk of command injection and ensure that administrative access is strictly managed and audited.

Description Summary:
Tenable Security Center is vulnerable to remote code execution during report generation, allowing an authenticated, non-administrative user to execute arbitrary code on the server.

Executive Summary:
A critical remote code execution vulnerability in Tenable Security Center allows an authenticated, low-privileged user to execute arbitrary code with service account privileges.

Vulnerability Details

CVE-ID: CVE-2026-19626

Affected Software: Tenable Security Center

Affected Versions: 0 up to (excluding) 6.9.0

Vulnerability: This is an eval injection vulnerability occurring within the report generation functionality. An authenticated user can supply malicious input during the server-side rendering process, which results in the execution of arbitrary code with the privileges of the underlying service account.

Business Impact

Successful exploitation allows an attacker to gain remote code execution capabilities on the host system. This can lead to total system compromise, unauthorized access to sensitive vulnerability data, and the potential for lateral movement within the network. Although the attack requires authentication, the high CVSS score of 9.9 reflects the extreme impact of arbitrary code execution on a security management platform.

Remediation Plan

Immediate Action: Update Tenable Security Center to version 6.9.0 or later, which is available via the Tenable Downloads Portal.

Proactive Monitoring: Monitor server logs for suspicious activities during report generation or unexpected process execution spawned by the Security Center service.

Compensating Controls: Limit access to the Security Center interface to trusted users only and ensure the application is segmented within the network to minimize potential lateral movement.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of Aug 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no evidence of active exploitation, and the automatability of the attack is low.

Analyst Recommendation

Given the critical nature of this remote code execution vulnerability, organizations should treat the update to version 6.9.0 as a high-priority task. Applying the patch is the only effective method to mitigate the risk of unauthorized system-level command execution.

Description Summary:
Tenable Sensor Proxy is vulnerable to remote code execution, allowing an unauthenticated attacker to gain elevated privileges if an operator connects the sensor to a malicious host.

Executive Summary:
A critical remote code execution vulnerability in Tenable Sensor Proxy permits attackers to gain elevated privileges through operator-assisted connection to malicious hosts.

Vulnerability Details

CVE-ID: CVE-2026-18667

Affected Software: Tenable Sensor Proxy

Affected Versions: 0 up to (excluding) 1.4.2

Vulnerability: This is a remote code execution vulnerability (CWE-94) that allows an unauthenticated attacker to execute code with elevated privileges. The attack vector relies on social engineering or deception, where an operator is induced to connect the sensor to an attacker-controlled host.

Business Impact

With a CVSS score of 9.6, this vulnerability represents a high-impact risk to organizational security infrastructure. Successful exploitation allows attackers to gain full administrative control over the sensor proxy, potentially facilitating lateral movement and unauthorized access to sensitive security telemetry.

Remediation Plan

Immediate Action: Update Tenable Sensor Proxy to version 1.4.2 immediately by downloading the installer from the official Tenable Downloads Portal.

Proactive Monitoring: Audit sensor configuration logs and connection endpoints to ensure sensors are only communicating with verified and trusted Tenable infrastructure.

Compensating Controls: Implement strict egress filtering on the network to prevent the sensor from establishing unauthorized connections to external or untrusted hosts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is primarily associated with the potential for an attacker to compromise the supply chain or perform man-in-the-middle attacks on the sensor connection process.

Analyst Recommendation

Organizations utilizing Tenable Sensor Proxy must prioritize the upgrade to version 1.4.2. Additionally, educate security personnel on the risks associated with connecting security appliances to untrusted or unverified network endpoints to prevent the exploitation of this vector.

Description Summary:
A privilege escalation vulnerability exists in the Tenable Nessus Agent Tray App for Windows during installation or uninstallation processes.

Executive Summary:
A vulnerability in the Tenable Nessus Agent for Windows allows local authenticated users to escalate privileges, potentially resulting in a full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-36640

Affected Software: Tenable Nessus Agent

Affected Versions: 0 up to 10.9.3, 11.0.0 up to 11.0.2

Vulnerability: This flaw, classified as Improper Privilege Management (CWE-269), occurs within the Tray App component during installation or uninstallation. A local user with low privileges can exploit this to achieve elevated system control.

Business Impact

Successful exploitation allows an attacker to gain elevated privileges on a host machine, which could lead to unauthorized system access, data exfiltration, or the deployment of persistent malware. Given the CVSS score of 8.8, this vulnerability represents a high risk to organizational security, particularly for environments where Nessus Agents are deployed across sensitive infrastructure.

Remediation Plan

Immediate Action: Update all Windows-based Nessus Agents to version 11.0.3 or 10.9.3 as specified in the official Tenable security advisory.

Proactive Monitoring: Review system logs for unusual process execution or unauthorized installation/uninstallation activity involving the Nessus Agent Tray App.

Compensating Controls: Restrict local user permissions on systems where Nessus Agents are installed and limit the ability of non-administrative users to trigger software installation or removal tasks.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of January 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires local access, which reduces the immediate attack surface but remains a significant concern for internal security posture.

Analyst Recommendation

Organizations should prioritize the deployment of the patched Nessus Agent versions across all Windows endpoints. Because this vulnerability facilitates privilege escalation, it is imperative to ensure that administrative controls are robust and that patch management cycles are strictly enforced to mitigate the risk of local exploitation.

Description Summary:
Tenable Nessus on Windows allows local, non-administrative users to overwrite arbitrary system files with log data, potentially leading to privilege escalation or system instability.

Executive Summary:
A high-severity privilege management vulnerability in Tenable Nessus for Windows allows authenticated local users to overwrite arbitrary system files at the SYSTEM privilege level.

Vulnerability Details

CVE-ID: CVE-2025-36630

Affected Software: Tenable Nessus

Affected Versions: 0 up to (excluding) 10.8.5

Vulnerability: This vulnerability, identified as CWE-269 (Improper Privilege Management), allows a low-privileged user to trigger file operations that result in the overwriting of arbitrary files on the host system. The attacker requires local access to the system but does not need administrative privileges to execute the attack.

Business Impact

The ability to overwrite arbitrary system files at the SYSTEM level presents a critical risk to host integrity. An attacker could potentially corrupt system configurations, replace critical binaries, or cause denial of service conditions. With a CVSS score of 8.4, this flaw is classified as High and poses a significant risk to the security posture of any host running the affected software.

Remediation Plan

Immediate Action: Upgrade to Nessus version 10.8.5 or 10.9.0 immediately to apply the vendor-provided patch.

Proactive Monitoring: Monitor system logs and file integrity for unexpected modifications to system-level files or unusual activity originating from non-administrative service accounts.

Compensating Controls: Restrict local access to the host system to trusted users only and ensure the principle of least privilege is strictly enforced for all local user accounts.

Exploitation Status

Public Exploit Available: exploit_available (false)

Analyst Notes: As of 2025-07-02, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently exploitable by any local user who can interact with the affected Nessus service on a Windows host.

Analyst Recommendation

Given the potential for privilege escalation and system file manipulation, this vulnerability should be prioritized for remediation. IT administrators should verify their current version of Nessus on all Windows deployments and perform the mandatory update to version 10.8.5 or later to neutralize the risk.