EUVD-2026-39409
GHSA-vqwf-3hj2-5ghm
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because attack is file-delivered with no network path; PR:N for attacker; UI:R for required privileged import; C:L only for scan data exfiltration.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.
AnalysisAI
SQL injection in Tenable Nessus's scan result import functionality allows an attacker to craft a malicious scan file that, when imported by a privileged operator, injects SQL into the scan results database and exfiltrates stored scan data. The attack is entirely dependent on social engineering: the threat actor has no direct access to the Nessus instance and must convince a privileged user to import the weaponized file. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific, simultaneous conditions: first, the attacker must successfully deliver a crafted malicious scan file to the target environment through a social engineering channel, as the attacker has no direct network path to the Nessus instance (AV:L); second, a privileged Nessus user must actively initiate an import of the malicious file through the Nessus scan import functionality (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 3.3 (Low) is calibrated correctly given the constrained attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a .nessus scan result file with SQL injection payloads embedded in scan result metadata fields and delivers it to a security analyst via email, a shared file repository, or a collaboration platform - framing it as legitimate scan output from a partner team or external assessment. When the privileged Nessus operator imports the file through the Nessus interface, the malicious SQL executes in the scan results database context and returns scan data to the attacker through the injection channel. … |
| Remediation | Apply the official Tenable patch as documented in advisory TNS-2026-17 (https://www.tenable.com/security/tns-2026-17); the CVSS temporal indicator RL:O confirms an official fix has been released, though the exact fixed version number is not specified in the provided data and must be verified directly from the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n
The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of servi
Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy cred
The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to
Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.Io: before Plugin Feed ID #202306261202 ; N
As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. Rated h
A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1.
An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with a
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks
In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrit
Nessus 8.5.2 and earlier on Windows platforms were found to contain an issue where certain system files could be overwri
Nessus 6.6.2 - 6.10.3 contains a flaw related to insecure permissions that may allow a local attacker to escalate privil
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today