Loading story…
Tenable released security updates for vulnerabilities affecting Nessus, Nessus Agent, and Tenable Identity Exposure, according to an EG-FinCIRT advisory. The flaws could enable SQL injection, sensitive information disclosure, or arbitrary code execution. The advisory highlights CVE-2026-15265, a Nessus Agent path traversal vulnerability rated CVSS 9.1 that can permit remote code execution, and CVE-2026-13007, an information disclosure vulnerability in Tenable Identity Exposure rated CVSS 7.5.
The advisory also lists CVE-2026-57587 and CVE-2026-57588, but the available references do not specify their individual impacts or affected versions. EG-FinCIRT recommends deploying the patches as soon as testing is completed. Organizations using the affected products should prioritize assessment and patching of Nessus Agent deployments given the critical code-execution risk, while addressing the remaining affected products through their patch-management process.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
EG-FinCIRT reported a Nessus Agent path traversal vulnerability, CVE-2026-15265, with a CVSS score of 9.1 that can permit remote code execution, and an Identity Exposure information disclosure vulnerability, CVE-2026-13007, scored 7.5. The advisory recommended deploying the patches as soon as testing is completed.
Tenable released updates addressing vulnerabilities that could permit SQL injection, sensitive information disclosure, or arbitrary code execution. The addressed vulnerabilities include CVE-2026-15265, CVE-2026-13007, CVE-2026-57587, and CVE-2026-57588.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tenable released security advisories for multiple products, including vulnerabilities in **Tenable Security Center** version `6.8.0` and earlier and an **arbitrary file deletion** flaw affecting **Nessus Agent** and **Nessus**. The Canadian Centre for Cyber Security urged organizations to review Tenable's advisories and apply vendor updates to reduce exposure across affected deployments. For Security Center, Tenable directed customers on versions `6.5.1`, `6.6.0`, `6.7.2`, and `6.8.0` to apply the stand-alone security patch `SC202604.1`. For the file deletion issue, affected versions include **Nessus Agent** before `11.1.3` and **Nessus** before `10.11.4` and `10.12.0`; Tenable identified `11.1.3`, `10.11.4`, and `10.12.0` as fixed releases. Administrators were advised to update promptly and verify product versions across vulnerability management infrastructure.
Jun 29, 2026
Tenable disclosed a critical path traversal vulnerability, tracked as **`CVE-2026-15265`**, affecting **Tenable/Nessus Agent** on **Linux, Windows, and macOS**. The flaw allows a privileged attacker to write arbitrary files outside the intended plugin directory, creating a path to **remote code execution**. The issue affects **version 11.2.0** and **11.1.3 and earlier**, and has been classified under **`CWE-22`** and **`CWE-347`** with high impact to confidentiality, integrity, and availability. Tenable released fixes in **versions 11.2.1 and 11.1.4**, and the **Canadian Centre for Cyber Security** issued advisory **AV26-705** urging organizations to review Tenable’s guidance and apply updates. CISA enrichment cited in vulnerability tracking data indicates **no known exploitation** so far, but assessed the technical impact as total, reinforcing the need for rapid patching across exposed agent deployments.
Jul 16, 2026
Tenable published a security advisory addressing **critical vulnerabilities** in **Tenable Security Center** affecting versions `6.6.0` through `6.8.0`, prompting a warning from the Canadian Centre for Cyber Security. The notice directs administrators to review Tenable’s advisory and apply updates to exposed systems, with the Cyber Centre emphasizing prompt remediation for affected deployments. A stand-alone patch, **`SC202607.1`**, is available for **Tenable Security Center** versions `6.6.0`, `6.7.2`, and `6.8.0`. The advisory fits a broader pattern of ongoing Tenable product security updates across its portfolio, but the immediate issue is the remediation of critical flaws in Security Center that could leave unpatched instances at significant risk.
Jul 21, 2026