Code injection in Tenable Sensor Proxy (CVE-2026-18667)

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host. The flaw is classified as code injection (CWE-94) and carries a CVSSv3 base score of 9.6 (Critical). Users are strongly encouraged to upgrade immediately. Affected versions: - Sensor Proxy 1.4.1 and earlier We recommend updating to: Sensor Proxy 1.4.2. CVSS 9.3 · our assessment: act_now Reference: https://www.tenable.com/security/tns-2026-21 Details: https://vuln.today/cve/CVE-2026-18667