CVE-2026-33694: Junction File Manipulation
Published Apr 23, 2026
·Updated
This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to execute malicious code with elevated SYSTEM privileges.
Affected Software
2 affected components
Tenable Nessus<=10.11.3
Tenable Nessus Agent<=11.1.2
Event History
Apr 23, 2026
CVE Published
via MITRE·06:09 PM
Data Sourced
via MITRE·06:09 PM
DescriptionWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Which products are listed as affected?
The affected software listed is Tenable Nessus and Tenable Nessus Agent.
2
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access, low privileges, and user interaction are required. It does not describe exploitation as requiring remote network access.
3
What is the potential impact if exploitation succeeds?
Successful exploitation can enable deletion of arbitrary files with SYSTEM privileges and may facilitate execution of malicious code with elevated SYSTEM privileges.