Nessus EUVD-2026-39408

The attacker must control the reverse DNS (PTR) record for at least one IP address that is included in the scope of a Nessus scan. This requires either owning or operating an internet-accessible host, or having the ability to manipulate DNS PTR records for an IP in the scan target range. The Nessus instance must perform reverse DNS lookups during scanning (likely a default or common behavior given this is the described attack vector). No authentication to Nessus is required, per CVSS PR:N. Exploitation is limited by the requirement that the attacker's host fall within an active Nessus scan scope - organizations that scan only internal hosts against a controlled DNS zone cannot be targeted externally. The SQL injection yields only read-level access to scan result data (C:L/I:N/A:N), not arbitrary write or OS command execution.

The NVD CVSS 5.3 (Medium) vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N captures a remote unauthenticated read-only injection path. The C:L/I:N/A:N profile limits real-world impact to scan-result confidentiality - the Nessus database itself, not the underlying OS. However, scan results may contain sensitive asset inventories, vulnerability findings, and network topology data, making exfiltration materially harmful to security posture. The CVSS temporal qualifier E:P confirms a proof-of-concept is known, elevating urgency relative to purely theoretical flaws. No CISA KEV listing means active widespread exploitation is not confirmed, but the low barrier to creating a malicious PTR record makes opportunistic exploitation plausible. One notable tension: AC:L implies no special conditions, yet exploiting this requires the attacker's IP to fall within a Nessus scan scope - a meaningful prerequisite the CVSS base vector does not fully capture. Real-world risk is therefore conditional on whether an organization scans externally reachable or attacker-influenced hosts.

An attacker who owns or controls an internet-facing IP address configures its PTR record to contain a SQL injection payload (e.g., a UNION SELECT or stacked query). When a security team runs a Nessus scan that includes this IP, Nessus performs a reverse DNS lookup and the malicious PTR value is inserted into a scan-result SQL query, executing the injected SQL against the results database. A proof-of-concept exists per the CVSS E:P temporal metric, indicating this attack path has been demonstrated.