CVE-2026-119317: Incorrect Authorization
On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tenable Pluginsto a version that resolves this vulnerability.Patch #202610282338
Event History
Frequently Asked Questions
Who is exposed to this issue?
Linux scanner hosts are affected when an authenticated low-privileged Nessus user has permission to create scans and can run a custom Unix compliance audit against the scanner itself.
What access does an attacker need to exploit it?
The attacker needs valid Nessus authentication, low-privileged account access, and scan-creation rights. No user interaction is required.
What could an attacker obtain?
An attacker could read arbitrary text files from the scanner host using the privileges of the nessusd process.