Tenable Nessus Tenable Nessus Agent
Monthly
Local privilege escalation in Tenable Nessus (≤10.11.3) and Nessus Agent (≤11.1.2) on Windows lets a low-privileged user abuse an NTFS junction to force the SYSTEM-level Nessus service into deleting arbitrary files, which can be leveraged for code execution as SYSTEM. Publicly available exploit code exists, but there is no evidence of active exploitation and the EPSS probability is negligible (0.01%, 3rd percentile). SSVC rates technical impact as total but exploitation as none and non-automatable, making this a credible but not urgent operator-side EoP.
Local privilege escalation in Tenable Nessus (≤10.11.3) and Nessus Agent (≤11.1.2) on Windows lets a low-privileged user abuse an NTFS junction to force the SYSTEM-level Nessus service into deleting arbitrary files, which can be leveraged for code execution as SYSTEM. Publicly available exploit code exists, but there is no evidence of active exploitation and the EPSS probability is negligible (0.01%, 3rd percentile). SSVC rates technical impact as total but exploitation as none and non-automatable, making this a credible but not urgent operator-side EoP.