EUVD-2026-25265
GHSA-hjr9-62gj-chhf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account
-
DeliveryPlant NTFS junction in Nessus service path
-
ExploitSYSTEM service triggers file operation
-
ExecutionArbitrary file deleted as SYSTEM
-
PersistPlant/redirect attacker binary
-
ImpactExecute code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Requires an authenticated low-privileged local account (PR:L) on a Windows system running Tenable Nessus ≤10.11.3 or Nessus Agent ≤11.1.2, plus write access to a filesystem location the SYSTEM service operates on so that a junction/reparse point can be planted. Exploitation is further gated by user/operator interaction (UI:A) - a privileged service action (e.g., scan, update, service restart) must occur to trigger the arbitrary file deletion - and by the attacker winning the redirected-file-operation timing. It is not remotely exploitable and does not work without a pre-existing local foothold; SSVC marks it non-automatable, limiting reliable mass exploitation. |
| Impact | The signals are consistent and point to a genuine but moderate, non-urgent risk. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:A) confirms this is a LOCAL attack requiring an existing low-privileged foothold and some user/operator interaction, not a remote unauthenticated exploit - despite the 'RCE' tag, the RCE is post-authentication local privilege escalation to SYSTEM, not network RCE. EPSS is extremely low (0.01%, 3rd percentile) and CISA SSVC records Exploitation: none and Automatable: no, which aligns with the absence of KEV listing; only Technical Impact is total. Public exploit code exists (per the CCB Belgium advisory), which raises practical feasibility, but no in-the-wild exploitation is confirmed. Net: prioritize as a standard-severity endpoint EoP patch, not an emergency - the local-only, interaction-dependent, non-automatable profile substantially caps real-world blast radius even though a successful attack yields full SYSTEM compromise. |
| Exploit ScenarioDerived | An attacker who already has a standard (non-admin) local account on a Windows host running a vulnerable Nessus or Nessus Agent plants an NTFS junction in a directory the SYSTEM-level service touches, redirecting a service file operation to a protected file. During a service action (an active user/operator interaction such as a scan, update, or restart) the service deletes the attacker-chosen file, which the attacker chains into loading an attacker-controlled binary and gaining SYSTEM-level code execution. Public exploit code for this technique is reported to exist, lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Local privilege escalation in Tenable Nessus (≤10.11.3) and Nessus Agent (≤11.1.2) on Windows lets a low-privileged user abuse an NTFS junction to force the SYSTEM-level Nessus service into deleting arbitrary files, which can be leveraged for code execution as SYSTEM. Publicly available exploit code exists, but there is no evidence of active exploitation and the EPSS probability is negligible (0.01%, 3rd percentile). SSVC rates technical impact as total but exploitation as none and non-automatable, making this a credible but not urgent operator-side EoP.
RemediationAI
Patch available per vendor advisory - upgrade Nessus beyond 10.11.3 and Nessus Agent beyond 11.1.2 to the fixed releases identified in Tenable advisories TNS-2026-12 (https://tenable.com/security/tns-2026-12) and TNS-2026-13 (https://tenable.com/security/tns-2026-13); the exact fixed build numbers should be taken directly from those advisories as they are not independently confirmed here. Because exploitation requires a local low-privileged account, effective compensating controls until patching are to restrict and audit interactive/local logon rights on hosts running Nessus, limit which users have write access to the Nessus program-data and working directories to prevent junction planting, and monitor for creation of NTFS junctions/reparse points in those paths (trade-off: reparse-point monitoring can be noisy and does not block the primitive, only detects it). Avoid running the scanner on multi-user or shared workstations where untrusted local users are present.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-59 link-following (junction/symlink) issue in the Nessus and Nessus Agent Windows service, which runs as NT AUTHORITY\SYSTEM. Because the privileged service operates on filesystem paths that a low-privileged user can influence, that user can plant an NTFS directory junction so that a file operation intended for a controlled location is redirected to an arbitrary target. The service then deletes a file it should not have access to; combining arbitrary file deletion primitives with well-known Windows Installer/rollback or DLL-planting techniques is a documented path to SYSTEM code execution. Affected CPE is cpe:2.3:a:tenable,_inc.:tenable_nessus,_tenable_nessus_agent, i.e. both the full Nessus scanner and the lightweight Nessus Agent.
Know when Tenable Nessus Tenable Nessus Agent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Local low-privileged user (AV:L/PR:L) abuses a junction that a SYSTEM service acts on (UI:R for the triggering service action, S:C as privilege boundary is crossed) yielding full SYSTEM C/I/A impact.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
3DescriptionCVE.org
This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to execute malicious code with elevated SYSTEM privileges.
Executive ViewAI
Tenable Nessus and Nessus Agent on Windows (versions 10.11.3 and earlier) contain a local privilege escalation vulnerability with publicly available exploit code that enables low-privileged users to achieve SYSTEM-level code execution. Organizations relying on Nessus for vulnerability assessment face risk of security tool compromise, potentially undermining the integrity of their scanning infrastructure and creating a high-value target for insider threats.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict local account logon privileges to Nessus hosts, implement filesystem auditing and alerting for NTFS junction manipulation, reduce Nessus service account to minimum required privileges, enforce application whitelisting to prevent unauthorized process execution, and deploy file integrity monitoring on critical system binaries that could be deletion targets.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB