Arbitrary Code Execution Vulnerability in Nessus, CVE-2026-33694
Summary
The Centre for Cybersecurity Belgium published a critical security warning on 27 April 2026 for CVE-2026-33694, a vulnerability affecting Nessus Agent <= 11.1.2 and Nessus <= 10.11.3 on Windows systems. The flaw, rated CVSS 7.4, allows an authenticated attacker to delete arbitrary files with SYSTEM privileges and potentially execute arbitrary code with elevated privileges. The CCB strongly recommends installing updates with the highest priority after thorough testing, and advises organisations to upscale monitoring and detection capabilities to identify suspicious activity.
“The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.”
About this source
GovPing monitors Belgium CCB News alt for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 8 changes logged to date.
What changed
CCB issued a security advisory disclosing CVE-2026-33694, an arbitrary code execution vulnerability in Tenable Nessus and Nessus Agent on Windows platforms running versions at or below 11.1.2 and 10.11.3 respectively. The vulnerability carries a CVSS 4.0 score of 7.4 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and enables authenticated attackers to delete arbitrary files with SYSTEM privileges, potentially facilitating arbitrary code execution at elevated privilege levels.
Organisations running affected Nessus deployments on Windows must treat this as a priority patching event. While the application is typically not publicly exposed, local or network access sufficient to exploit the flaw can lead to full system compromise with high impact on confidentiality, integrity, and availability. CCB recommends immediate patching after thorough testing and enhanced monitoring for signs of exploitation.
What to do next
- Patch vulnerable Nessus installations to the latest version immediately after testing
- Upscale monitoring and detection capabilities to identify suspicious activity related to this vulnerability
- Report any intrusion to CCB via the incident reporting portal
Archived snapshot
Apr 28, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Warning: Arbitrary code execution vulnerability in Nessus can be exploited to elevate privileges, Patch Immediately!
Image
Published : 27/04/2026
- Last update: 27/04/2026
- Affected software: → Nessus Agent <= 11.1.2 → Nessus <= 10.11.3
- Type: Arbitrary code execution, deletion of arbitrary files
- CVE/CVSS → CVE-2026-33694: CVSS 7.4 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P) →
Sources
Tenable security advisory - https://www.tenable.com/security/tns-2026-12
Tenable security advisory - https://www.tenable.com/security/tns-2026-13
Risks
Nessus running on a Windows system can be vulnerable to the deletion of arbitrary files with the highest privileges. This condition can allow attackers to potentially facilitate arbitrary code execution with elevated privileges, resulting in malicious code being executed. The Nessus application is typically not publicly exposed so an attacker would need local (network) access to exploit this vulnerability. Attackers can target these vulnerable systems to escalate their privileges and further attack other internal systems. A full compromise can have a high impact on the confidentiality, integrity, and availability of the system.
Description
CVE-2026-33694 is a vulnerability in the Nessus applications on Windows including the Nessus Agent, where an attacker can enable the deletion of arbitrary files with SYSTEM privileges. This condition could potentiality facilitate arbitrary code execution on the affected system with SYSTEM privileges.
Recommended Actions
Patch
The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.
Monitor/Detect
The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion.
In case of an intrusion, you can report an incident via https://ccb.belgium.be/en/cert/report-incident.
While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.
References
Parties
Related changes
Get daily alerts for Belgium CCB News alt
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CCB.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when Belgium CCB News alt publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.