CVE-2026-57588: 
Tenable Nessus vulnerability analysis and mitigation

CVE-2026-57588 is a SQL injection vulnerability in Tenable Nessus that allows an attacker to craft a malicious scan result file which, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data. It affects all Nessus versions prior to 10.12.1. The vulnerability was reported to Tenable on 2026-05-15, accepted on 2026-06-09, and patched with the release of Nessus 10.12.1 on 2026-06-25. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 1.8 (Low) (Tenable Advisory, GitHub Advisory).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning Nessus fails to adequately sanitize or parameterize data parsed from imported scan result files before incorporating it into SQL queries against the scan results database. The attack vector is local, requiring no privileges from the attacker but necessitating active user interaction — specifically, a privileged Nessus user must import the maliciously crafted file. The companion vulnerability CVE-2026-57587 covers a related SQL injection vector via reverse DNS records. Both were credited to researcher Tristan Madani (@TristanInSec) from Talence Security (Tenable Advisory).

Successful exploitation results in a limited confidentiality impact: an attacker can exfiltrate data from the Nessus scan results database, which may contain sensitive information about scanned hosts, discovered vulnerabilities, and network topology. There is no integrity or availability impact, and the scope is unchanged, meaning the attack is confined to the Nessus application's database. Because exploitation requires a privileged user to import the malicious file, the practical blast radius is constrained, but the exposed scan data could be leveraged for reconnaissance or targeted follow-on attacks (Tenable Advisory, GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit at this time, though the CVSS v4.0 exploit maturity is rated as "Proof of Concept" in the scoring vector. The EPSS score is approximately 0.158%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Tenable Advisory, GitHub Advisory).

1. Craft malicious scan result file: The attacker creates a specially crafted Nessus scan result file (e.g., a .nessus XML file) containing SQL injection payloads embedded within fields that are parsed and inserted into the database upon import (e.g., hostname, plugin output, or other scan metadata fields).
2. Deliver the file to a privileged user: Since exploitation requires user interaction, the attacker uses social engineering, phishing, or supply-chain manipulation to deliver the malicious file to a Nessus administrator or privileged user who has the ability to import scan results.
3. Trigger the import: The privileged user imports the malicious scan result file into Nessus via the standard scan import functionality.
4. SQL injection executes: Nessus processes the file and inserts unsanitized content into SQL queries against the scan results database, causing the injected SQL to execute.
5. Exfiltrate scan-result data: The injected SQL commands extract sensitive scan-result data from the database, potentially exposing information about scanned hosts, vulnerabilities, and network configurations (Tenable Advisory).

• File System: Unexpected or externally sourced .nessus scan result files present in import directories or user download locations; files with anomalous metadata or unusually large/malformed XML structures.
• Logs: Nessus application or database logs showing SQL errors, unexpected query structures, or anomalous data patterns during scan result import operations; database query logs containing SQL syntax inconsistent with normal Nessus operations.
• Process/Application: Nessus import operations that take unusually long or produce unexpected errors; database activity spikes coinciding with scan result imports from untrusted sources.

Tenable has released Nessus version 10.12.1 to address CVE-2026-57588 (and the related CVE-2026-57587). Users should upgrade to Nessus 10.12.1 or later immediately via the Tenable Downloads Portal. As interim mitigations, organizations should restrict who is permitted to import scan result files, validate and inspect imported files before processing, and monitor database logs for suspicious SQL activity during import operations (Tenable Advisory).

The vulnerability was discovered and reported by Tristan Madani (@TristanInSec) of Talence Security, who received credit in Tenable's official advisory. Tenable responded promptly, moving from report receipt (2026-05-15) to patch release (2026-06-25) in approximately six weeks. No significant broader media coverage or notable community commentary beyond the standard advisory distribution has been identified at this time (Tenable Advisory).