Tenable Sensor Proxy EUVD-2026-52490

Exploitation requires an operator to be induced (through social engineering or a manipulated provisioning step) into connecting a vulnerable Sensor Proxy (version < 1.4.2) to a host the attacker controls, and the attacker must stand up and serve that malicious upstream endpoint. It does not fire against a default, correctly configured deployment that only communicates with legitimate Tenable backends - the operator's connect-to-attacker action is the gating limiter, which contradicts the vendor's UI:N metric and materially reduces opportunistic, drive-by exploitation.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA all High) produces 9.3 and implies trivial unauthenticated network exploitation with total impact. This conflicts with the description, which explicitly requires 'inducing an operator to connect the sensor to an attacker-controlled host' - a social-engineering/user-interaction precondition not reflected by the vendor's UI:N, so real-world exploitability is lower than the raw score suggests (CVSS marks UI:N but the description implies required operator action - verify with vendor). No EPSS score, SSVC decision, POC, or KEV entry was provided, so this is not confirmed actively exploited. Net: high-severity by impact but interaction-gated, making it a real priority for shops running Tenable distributed sensors rather than a mass-exploitable, worm-class issue.

An attacker stands up a malicious host and, via phishing or a spoofed provisioning instruction, convinces a Tenable operator to connect a sensor proxy to it. On connection the attacker's host delivers injected code that the proxy executes with elevated privileges, handing the attacker control of the sensor host. No public exploit code has been identified at time of analysis.