Which versions of Tenable Sensor Proxy are affected by CVE-2026-18667?

Tenable Sensor Proxy versions prior to 1.4.2 contain a critical vulnerability (CVE-2026-18667, CVSS 9.3) that could allow attackers to take control of your security monitoring infrastructure through…. A patch is available.

How to fix or mitigate CVE-2026-18667?

Within 24 hours, conduct an inventory of all Tenable Sensor Proxy deployments and identify which systems run versions before 1.4.2. Within 7 days, plan and begin staged deployment of Sensor Proxy version 1.4.2 starting with systems that monitor critical assets. Within 30 days, complete upgrade of all vulnerable Sensor Proxy instances and validate normal operation.

Tenable Sensor Proxy CVE-2026-18667

Q: What is the CVSS score of CVE-2026-18667?

CVE-2026-18667 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-52490 CRITICAL

Code Injection (CWE-94)

2026-08-03 tenable

GHSA-24h7-mgmp-x4j6

RCE Code Injection Sensor Proxy Tenable Inc

9.3

CVSS 4.0 · Vendor: tenable

Severity by source

Vendor (tenable) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network vector with low complexity and no auth, but the description's operator-induced connection makes this UI:R rather than UI:N; full CIA impact on the proxy host.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (tenable).

CVSS VectorVendor: tenable

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 03, 2026 - 23:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 03, 2026 - 23:22 vuln.today

cvss_changed

CVSS changed

Aug 03, 2026 - 23:22 NVD

9.6 (CRITICAL) 9.3 (CRITICAL)

Patch available

Aug 03, 2026 - 23:02 EUVD

Analysis Generated

Aug 03, 2026 - 22:50 vuln.today

CVE Published

Aug 03, 2026 - 22:27 cve.org

CRITICAL 9.6

DescriptionCVE.org

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.

AnalysisAI

Remote code execution in Tenable Sensor Proxy (versions before 1.4.2) lets an attacker run code with elevated privileges by luring an operator into connecting the sensor to an attacker-controlled host. The CWE-94 code-injection flaw is triggered during that connection, and the CVSS 4.0 score of 9.3 reflects full compromise of confidentiality, integrity, and availability on the proxy host. There is no public exploit identified at time of analysis and it is not on CISA KEV, but a vendor patch is available.

Technical ContextAI

Tenable Sensor Proxy is a component of Tenable's vulnerability-management ecosystem (Nessus / Tenable Vulnerability Management / Security Center) that relays scan traffic between distributed sensors and the management backend; the affected product per CPE is cpe:2.3:a:tenable,_inc.:sensor_proxy. The root cause is CWE-94 (Improper Control of Generation of Code, i.e. code injection): when the sensor is directed to connect to a malicious upstream host, that host supplies content the proxy interprets and executes, running with the elevated privileges the proxy process holds.

RemediationAI

Vendor-released patch: upgrade Tenable Sensor Proxy to version 1.4.2 or later per the Tenable advisory at https://www.tenable.com/security/tns-2026-21. Until upgrading, the most effective compensating control targets the specific precondition: ensure operators connect sensors only to known, pre-validated management hosts and reject any prompt or instruction to point a sensor at an unverified endpoint (side effect: adds operational friction to legitimate re-provisioning). Additionally, restrict outbound paths from sensor hosts with egress firewall rules that permit only the approved Tenable backend addresses (side effect: breaks connectivity if backend IPs change without a rule update), which prevents a sensor from reaching an attacker-controlled host even if an operator is tricked.