Tenable Nessus Arbitrary Code Execution Vulnerability Advisory
Summary
CERT-Bund published security advisory WID-SEC-2026-1255 warning of a high-severity vulnerability in Tenable Security Nessus and Nessus Agent products. The vulnerability (CVSS Base Score 8.2) allows a local attacker to execute arbitrary program code with the privileges of the Nessus service. Affected product versions include Nessus <10.11.4, Nessus <10.12.0, and Nessus Agent <11.1.3 running on Linux, UNIX, and Windows operating systems. A mitigation is available; affected parties should update to the patched versions.
“Ein lokaler Angreifer kann eine Schwachstelle in Tenable Security Nessus ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.”
About this source
CERT-Bund is the German federal cybersecurity agency's incident response team, run by the BSI. Their advisory feed publishes vulnerability disclosures and active exploitation warnings for software in widespread enterprise use: VPN appliances, email servers, file transfer products, ERP systems, browsers, hypervisors. Around 280 advisories a month, each with a CVSS score, affected versions, and remediation guidance. The advisories are written in German but cover the same vulnerabilities that show up in CISA, NCSC-UK, and JPCERT bulletins, often hours earlier. Watch this if you patch enterprise software, run a SOC, or write detection rules. GovPing publishes each advisory with the affected vendor, CVSS score, and original CERT-Bund link.
What changed
CERT-Bund issued a security advisory disclosing a high-severity arbitrary code execution vulnerability in Tenable Security Nessus vulnerability scanner products. The vulnerability affects Nessus versions prior to 10.11.4 and 10.12.0, and Nessus Agent versions prior to 11.1.3, across Linux, UNIX, and Windows platforms. With a CVSS Base Score of 8.2 (High), a local attacker who can access the system can exploit the flaw to run arbitrary code with the rights of the Nessus service process.
Organizations running affected Nessus or Nessus Agent installations should apply the available updates immediately as a priority security measure. Given that Nessus is widely used for vulnerability scanning and compliance auditing, this vulnerability in a scanner with elevated privileges presents a significant risk if exploited. Security teams should inventory Nessus deployments, verify current versions, and ensure patches or upgrades are deployed to all affected systems.
What to do next
- Update Tenable Security Nessus to version 10.11.4 or later, or version 10.12.0 or later
- Update Tenable Security Nessus Agent to version 11.1.3 or later
Archived snapshot
Apr 24, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
[WID-SEC-2026-1255] Tenable Security Nessus: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes CVSS Base Score 8.2 (hoch) CVSS Temporal Score 7.1 (hoch) Remoteangriff nein Datum 23.04.2026 Stand 24.04.2026 Mitigation ja
Betroffene Systeme
Betriebssystem
- Linux
- UNIX
- Windows
Produktbeschreibung
Nessus ist ein Schwachstellen-Scanner, welcher neben bekannten Schwachstellen auch Software-Patchstände und Konfigurationen überprüfen kann.
Produkte
23.04.2026
- Tenable Security Nessus <10.11.4
Tenable Security Nessus <10.12.0
Tenable Security Nessus Agent <11.1.3
Angriff
Angriff
Ein lokaler Angreifer kann eine Schwachstelle in Tenable Security Nessus ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben
Related changes
Get daily alerts for CERT-Bund Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.