CVE-2026-119317EUVD-2026-113393
Incorrect Authorization
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The vulnerability affects Nessus vulnerability scanner installations running on Linux. An authenticated user with low privileges and permission to create scans could read arbitrary text files on the scanner host, including files the user should not be able to access, by abusing a custom Unix compliance audit.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Tenable, Inc. Plugin Feed
fixed in 202610282338