Tenable Nessus CVE-2026-33694

Requires an authenticated low-privileged local account (PR:L) on a Windows system running Tenable Nessus ≤10.11.3 or Nessus Agent ≤11.1.2, plus write access to a filesystem location the SYSTEM service operates on so that a junction/reparse point can be planted. Exploitation is further gated by user/operator interaction (UI:A) - a privileged service action (e.g., scan, update, service restart) must occur to trigger the arbitrary file deletion - and by the attacker winning the redirected-file-operation timing. It is not remotely exploitable and does not work without a pre-existing local foothold; SSVC marks it non-automatable, limiting reliable mass exploitation.

The signals are consistent and point to a genuine but moderate, non-urgent risk. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:A) confirms this is a LOCAL attack requiring an existing low-privileged foothold and some user/operator interaction, not a remote unauthenticated exploit - despite the 'RCE' tag, the RCE is post-authentication local privilege escalation to SYSTEM, not network RCE. EPSS is extremely low (0.01%, 3rd percentile) and CISA SSVC records Exploitation: none and Automatable: no, which aligns with the absence of KEV listing; only Technical Impact is total. Public exploit code exists (per the CCB Belgium advisory), which raises practical feasibility, but no in-the-wild exploitation is confirmed. Net: prioritize as a standard-severity endpoint EoP patch, not an emergency - the local-only, interaction-dependent, non-automatable profile substantially caps real-world blast radius even though a successful attack yields full SYSTEM compromise.

An attacker who already has a standard (non-admin) local account on a Windows host running a vulnerable Nessus or Nessus Agent plants an NTFS junction in a directory the SYSTEM-level service touches, redirecting a service file operation to a protected file. During a service action (an active user/operator interaction such as a scan, update, or restart) the service deletes the attacker-chosen file, which the attacker chains into loading an attacker-controlled binary and gaining SYSTEM-level code execution. Public exploit code for this technique is reported to exist, lowering the skill barrier.