CVE-2026-119317
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
On Linux, an authenticated low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself.
Risk Assessment
This can lead to disclosure of sensitive data from the scanner host to low-privileged users, violating least-privilege principles and potentially exposing confidential information.
Recommendation
Restrict scan-creation and custom compliance audit rights to trusted administrators and apply the vendor fix once available.
Other vulnerabilities in Nessus
See all- CVE-2017-11506High
Nessus 6.x before version 6.11 does not verify the manager's TLS certificate when making the initial outgoing connection. This could allow man-in-the-middle attacks.
- CVE-2017-7850High
Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local privilege escalation issue due to insecure permissions when running in Agent Mode.
- CVE-2017-7199High
Nessus versions 6.6.2 to 6.10.3 contain a flaw related to insecure permissions that may allow a local attacker to escalate privileges when the software is running in Agent Mode.
- CVE-2026-103946High
An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.
- CVE-2026-57588Low
A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.
- CVE-2026-57587Medium
A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.
- CVE-2023-3251Medium
A pass-back vulnerability exists in the Nessus application before version 10.6.0, allowing an authenticated remote attacker with administrator privileges to uncover stored SMTP credentials.
Original NVD description (English source)
On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS