Tenable Nessus CVE-2026-103946

Exploitation requires a valid authenticated Nessus account (PR:L) on an instance running a version below 10.12.5; the attacker needs network access to the Nessus web interface/API but no user interaction and no elevated privileges. The limiting factor is that this is not exploitable by unauthenticated outsiders - an attacker must first obtain or be granted low-privilege credentials, which constrains realistic exposure to environments where untrusted or many users have Nessus accounts (e.g., multi-user or multi-tenant deployments). The specific vulnerable feature or parameter is not identified in the available data.

This is a credible, elevated-priority issue but not an emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L, base 8.7 HIGH) indicates network-reachable exploitation with low attack complexity and no user interaction, but it explicitly requires low-level privileges (PR:L) - meaning the attacker must already hold a valid authenticated Nessus account. Exploitation status is 'no public exploit identified at time of analysis': there is no CISA KEV listing, no EPSS score provided, and no POC indicated in the sources, so there is no evidence of active or widespread exploitation. The signals are internally consistent (SQLi/CWE-89 aligns with high confidentiality and integrity impact on stored scan data), with no contradictions between the CVSS vector and the description. The main factor tempering raw severity is the authentication requirement: this is primarily a post-authentication privilege/data-exposure escalation (a low-privileged user reading or modifying data they should not control) rather than a pre-auth internet-facing crisis. Net assessment: patch promptly given the sensitivity of data a vulnerability scanner holds, but the absence of KEV/EPSS/POC signals means this is not currently a mass-exploitation threat. EPSS and POC data were not supplied and should be checked to refine prioritization.

An attacker with a low-privileged but valid Nessus account submits crafted input to a vulnerable parameter, injecting SQL that the backend executes against the Nessus datastore. This lets them read sensitive scan results, credentials, or configuration belonging to other users/tenants, or modify stored data, without any additional privileges or user interaction. No public exploit code has been identified, so exploitation currently requires the attacker to independently develop the injection.