EUVD-2026-43701
GHSA-h23h-6wgx-rvw7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Privileged control over the plugin input is required (PR:H) and traversal is straightforward (AC:L); the write executes as a higher-privileged service crossing a trust boundary, so S:C with full C/I/A impact.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
3DescriptionCVE.org
A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code execution.
AnalysisAI
Arbitrary file write via path traversal in Tenable Agent 11.2.0 and 11.1.3 and earlier lets a privileged attacker escape the intended plugin directory and drop files at attacker-chosen paths, potentially escalating to remote code execution. The flaw is vendor-reported (Tenable TNS-2026-18) and affects the endpoint scanning agent that typically runs with elevated/service privileges. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Tenable Agent (the Nessus/Tenable.io endpoint agent) periodically downloads and unpacks vulnerability plugin content into a managed plugin directory on the host. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), meaning a supplied path component (e.g. '../' sequences) is not properly canonicalized or constrained, so a write operation intended for the plugin directory can traverse to arbitrary filesystem locations. Because the agent process commonly runs as a privileged service account (SYSTEM/root), an out-of-bounds write can land in a location that is later executed or loaded, converting a file-write primitive into code execution. The affected CPE is cpe:2.3:a:tenable:tenable_agent:*, i.e. the agent software itself rather than the Nessus scanner manager.
RemediationAI
Upgrade Tenable Agent to the fixed release identified in Tenable's advisory TNS-2026-18 (https://www.tenable.com/security/tns-2026-18) - the input data names 11.2.0 and 11.1.3-and-lower as vulnerable but does not include an exact fixed version string, so confirm the patched build number directly from that advisory before deploying (do not assume a version). Until patched, reduce exposure by tightly restricting who can influence the agent's plugin/update channel and configuration: ensure agents link only to trusted, authenticated Nessus Manager/Tenable.io controllers, restrict local write/administrative access to the agent installation and plugin directories to the service account only, and monitor those directories for unexpected file writes (side effect: legitimate plugin updates also write there, so tune alerting to out-of-tree paths). Because exploitation requires high privilege, hardening privileged access to the hosts running the agent is itself a meaningful compensating control.
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today