CVE-2026-2026: 
Tenable Nessus Agent vulnerability analysis and mitigation

CVE-2026-2026 is a weak file permissions vulnerability (CWE-276: Incorrect Default Permissions) affecting Tenable Nessus Agent on Windows hosts. Insufficient directory permissions allow a low-privileged local attacker to read sensitive configuration files or trigger Denial of Service (DoS) conditions against the Nessus Agent service. Affected versions include Nessus Agent 11.0.3 and earlier, as well as versions 11.1.0 through 11.1.1. The vulnerability was reported to Tenable on 2025-11-03, confirmed on 2025-12-09, and patched on 2026-02-12. It carries a CVSSv3.1 base score of 6.1 (Medium) (Tenable Advisory).

The root cause is CWE-276 (Incorrect Default Permissions): the Nessus Agent installation directory on Windows is configured with overly permissive access controls, allowing low-privileged users to read or manipulate files within it. An attacker with local access and standard user privileges can leverage this misconfiguration to access sensitive configuration files or interfere with the agent's operation, potentially causing a DoS. The attack vector is local, requires low privileges, no user interaction, and has low attack complexity. The vulnerability was discovered and reported by the Lockheed Martin Red Team (Tenable Advisory).

A low-privileged local attacker can exploit this vulnerability to read sensitive Nessus Agent configuration files (confidentiality impact: low) or disrupt the availability of the Nessus Agent service through a DoS attack (availability impact: high). Integrity is not directly affected. The scope is limited to the local host; there is no evidence of lateral movement potential or remote exploitation capability (Tenable Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been observed as of the time of reporting. The CVSSv4 exploit maturity is rated as "Proof of Concept," though no specific PoC has been publicly released. The EPSS score is approximately 0.011% (0.000110), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Tenable Advisory).

1. Reconnaissance: Identify Windows hosts running a vulnerable version of Tenable Nessus Agent (11.0.3 or earlier, or 11.1.0–11.1.1) using local system enumeration or asset inventory tools.
2. Locate the Nessus Agent directory: Navigate to the Nessus Agent installation directory (typically C:\Program Files\Tenable\Nessus Agent\) and enumerate its file permissions using tools such as icacls or accesschk.exe.
3. Access sensitive files: With low-privileged user access, read configuration files (e.g., agent configuration, credentials, or policy files) that should be restricted to administrators, leveraging the overly permissive directory ACLs.
4. Trigger DoS: Manipulate, delete, or corrupt critical agent files or directories that the Nessus Agent service depends on, causing the service to crash or fail to restart, resulting in a Denial of Service condition (Tenable Advisory).

• File System: Unexpected access or modification timestamps on files within the Nessus Agent installation directory (e.g., C:\Program Files\Tenable\Nessus Agent\); missing or corrupted agent configuration files.
• Logs: Windows Security Event Logs showing low-privileged user accounts accessing the Nessus Agent directory (Event ID 4663 – Object Access); Nessus Agent service crash or restart events in the Windows Event Log (Event ID 7034 or 7036).
• Process: Nessus Agent service (nessus-agent.exe) unexpectedly stopping or failing to start; unusual processes reading files from the Nessus Agent directory under non-administrative user accounts.

Tenable has released patched versions Nessus Agent 11.0.4 and 11.1.2 to address this vulnerability. Users running Nessus Agent 11.0.3 or earlier should upgrade to 11.0.4; users on 11.1.0 or 11.1.1 should upgrade to 11.1.2. Installation files are available from the Tenable Downloads Portal. As an interim workaround, administrators should manually restrict access to the Nessus Agent installation directory using Windows ACLs (e.g., via icacls) to allow only SYSTEM and local Administrators, and limit local user access to systems hosting Nessus Agent (Tenable Advisory).

The vulnerability was credited to the Lockheed Martin Red Team, indicating it was discovered through professional security research. Coverage has been limited to vulnerability aggregator sites and security news digests, with no significant public researcher commentary or social media discussion observed. The moderate severity rating and local-only attack vector have kept community interest relatively low (Tenable Advisory).