Which versions of Tenable Nessus are affected by CVE-2026-33694?

Tenable Nessus and Nessus Agent on Windows (versions 10.11.3 and earlier) contain a local privilege escalation vulnerability with publicly available exploit code that enables low-privileged users to…

Is there a public PoC exploit available for CVE-2026-33694?

Yes, a public proof-of-concept exploit is available for CVE-2026-33694. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-33694?

Within 24 hours: conduct an inventory of Nessus and Nessus Agent deployments across your environment and identify all systems running versions 10.11.3 or earlier (Nessus) or 11.1.2 or earlier (Agent). Within 7 days: restrict local administrative and standard user logon access to Nessus systems, implement filesystem auditing for NTFS junction creation, and document current Nessus service account privilege levels for future remediation. Within 30 days: monitor Tenable's security advisories for patch availability and prepare upgrade plans targeting patched versions immediately upon release; simultaneously deploy endpoint detection and response (EDR) monitoring focused on suspicious file deletion patterns in system directories.

Tenable Nessus CVE-2026-33694

Q: What is the CVSS score of CVE-2026-33694?

CVE-2026-33694 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25265 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-04-23 tenable

GHSA-hjr9-62gj-chhf

RCE Tenable Nessus Tenable Nessus Agent Tenable Inc

7.4

CVSS 4.0 · Vendor: tenable

Severity by source

Vendor (tenable) PRIMARY

7.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Local low-privileged user (AV:L/PR:L) abuses a junction that a SYSTEM service acts on (UI:R for the triggering service action, S:C as privilege boundary is crossed) yielding full SYSTEM C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (tenable).

CVSS VectorVendor: tenable

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:37 vuln.today

PoC Detected

Apr 24, 2026 - 14:50 vuln.today

Public exploit code

CVSS changed

Apr 23, 2026 - 19:27 NVD

7.4 (HIGH)

EUVD ID Assigned

Apr 23, 2026 - 19:00 euvd

EUVD-2026-25265

CVE Published

Apr 23, 2026 - 18:09 nvd

HIGH 7.4

DescriptionCVE.org

This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to execute malicious code with elevated SYSTEM privileges.

AnalysisAI

Local privilege escalation in Tenable Nessus (≤10.11.3) and Nessus Agent (≤11.1.2) on Windows lets a low-privileged user abuse an NTFS junction to force the SYSTEM-level Nessus service into deleting arbitrary files, which can be leveraged for code execution as SYSTEM. Publicly available exploit code exists, but there is no evidence of active exploitation and the EPSS probability is negligible (0.01%, 3rd percentile). SSVC rates technical impact as total but exploitation as none and non-automatable, making this a credible but not urgent operator-side EoP.

Technical ContextAI

The flaw is a CWE-59 link-following (junction/symlink) issue in the Nessus and Nessus Agent Windows service, which runs as NT AUTHORITY\SYSTEM. Because the privileged service operates on filesystem paths that a low-privileged user can influence, that user can plant an NTFS directory junction so that a file operation intended for a controlled location is redirected to an arbitrary target. The service then deletes a file it should not have access to; combining arbitrary file deletion primitives with well-known Windows Installer/rollback or DLL-planting techniques is a documented path to SYSTEM code execution. Affected CPE is cpe:2.3:a:tenable,_inc.:tenable_nessus,_tenable_nessus_agent, i.e. both the full Nessus scanner and the lightweight Nessus Agent.

RemediationAI

Patch available per vendor advisory - upgrade Nessus beyond 10.11.3 and Nessus Agent beyond 11.1.2 to the fixed releases identified in Tenable advisories TNS-2026-12 (https://tenable.com/security/tns-2026-12) and TNS-2026-13 (https://tenable.com/security/tns-2026-13); the exact fixed build numbers should be taken directly from those advisories as they are not independently confirmed here. Because exploitation requires a local low-privileged account, effective compensating controls until patching are to restrict and audit interactive/local logon rights on hosts running Nessus, limit which users have write access to the Nessus program-data and working directories to prevent junction planting, and monitor for creation of NTFS junctions/reparse points in those paths (trade-off: reparse-point monitoring can be noisy and does not block the primitive, only detects it). Avoid running the scanner on multi-user or shared workstations where untrusted local users are present.