CVE-2026-103946

Nessus is a tool businesses use to scan their own computers and networks for security weaknesses. This bug is like a faulty lock on a filing cabinet inside the tool itself: someone who already has a valid login could twist the mechanism to read or alter the sensitive scan reports stored inside, even if they shouldn't normally have that level of access.

This matters to you if you run Tenable Nessus to scan your network for vulnerabilities. The risk applies to any Nessus deployment, but it can only be triggered by someone who already has a valid user account on the Nessus instance — there is no way to exploit it without logging in first.

There is no confirmed active exploitation and no public exploit code yet, but security attention around this issue is rising, and Tenable has already shipped a fix. Given that Nessus stores sensitive vulnerability and network data, this should be treated as a priority to patch rather than something to defer.

Confirm exposure by checking the installed Nessus version via the web console (Help > About) or the CLI (nessuscli --version). Any version prior to 10.12.5 is vulnerable. Upgrade to Nessus 10.12.5 or later, downloaded directly from the official Tenable Downloads Portal (https://www.tenable.com/downloads/nessus); there is no documented breaking-change path noted by the vendor for this release. As a temporary mitigation if patching must be delayed, restrict Nessus login access to a minimal set of trusted administrators, since exploitation requires an authenticated session, and audit existing user accounts for unnecessary privileges. No CISA KEV listing exists for this CVE, so there is no federal remediation deadline, but monitor Tenable's advisories and your own Nessus audit logs for unusual query behavior or unauthorized data access attempts post-patch.

CVSS 3.1 score 8.3 (High) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L — reflects network-exploitable SQL injection requiring low privileges, no user interaction, with high confidentiality and integrity impact and low availability impact. Weakness type is CWE-89 (SQL Injection). EPSS predicts low near-term exploitation likelihood with a flat trend, and it is not listed in CISA KEV; no public exploit code is currently known. Exploit maturity is therefore theoretical/unconfirmed, though press coverage is rising, which may indicate growing researcher or attacker interest ahead of broader exploitation.