Tenable Nessus: SQL injection allows data read/modify by authenticated users
Summary
Tenable Nessus up to version 10.12.4 contains an SQL injection vulnerability (CWE-89). An authenticated user with low privileges can read or modify data stored by Nessus, and no user interaction is required. Tenable rates the issue High (CVSS 4.0 score 8.7; CVSS 3.1 score 8.3 in the advisory), and the flaw is fixed in version 10.12.5.
Affected
- Nessus 10.12.4 and earlier
- The CVE record lists the range below 10.12.5
Fixed in
- Nessus 10.12.5 (installation files via the Tenable Downloads Portal)
Workaround
Unknown.
Exploitation
- No public proof of concept found for this CVE.
- Not listed in the CISA KEV catalog; no evidence of exploitation in the wild.
- CISA SSVC: not automatable.
- EPSS score 0.00378 at the time of the source.
- CVE-2026-57588 is a different, earlier Nessus SQL injection with a public PoC; it does not change the status of this CVE.
Our recommendation
- Upgrade all Nessus instances to version 10.12.5 or later.
- Also check the other CVEs in Tenable advisory TNS-2026-26, which are fixed in the same release.
- Until patched, restrict access to the Nessus web interface to admin hosts or a VPN and do not expose it to the internet.
- Review which accounts have Nessus logins and remove unneeded ones.
- Monitor for a public proof of concept or a CISA KEV entry for this CVE.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Tenable Security Advisory TNS-2026-26 www.tenable.com
- Tenable Nessus release notes 2026 docs.tenable.com
- OpenCVE: CVE-2026-103946 app.opencve.io
- Vulners VulnRichment: CVE-2026-103946 vulners.com
- VulDB entry 420135 vuldb.com
- Strix AI: CVE-2026-103946 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:01.
Original description (NVD)
An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.