CVE-2026-15265 Overview
CVE-2026-15265 is a path traversal vulnerability [CWE-22] affecting Tenable Agent versions 11.2.0 and 11.1.3 and earlier. A privileged attacker can write arbitrary files outside the intended plugin directory. Successful exploitation can lead to remote code execution on the host running the agent.
Tenable published the fix in security advisory TNS-2026-18. The vulnerability is network exploitable but requires high privileges, limiting the attacker population to authenticated actors with elevated agent access.
Critical Impact
Arbitrary file write outside the plugin directory can be escalated to remote code execution under the privileges of the Tenable Agent process, which typically runs with system-level rights.
Affected Products
- Tenable Agent 11.2.0
- Tenable Agent 11.1.3 and earlier
- Deployments across Windows, macOS, and Linux endpoints running vulnerable agent builds
Discovery Timeline
- 2026-07-14 - CVE-2026-15265 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-15265
Vulnerability Analysis
The flaw resides in how Tenable Agent handles file paths when writing plugin content to disk. The agent fails to properly validate or canonicalize path components supplied during plugin installation or update operations. An attacker with privileged access to the agent's control channel can supply path segments such as ..\ or ../ to escape the intended plugin directory.
Because the Tenable Agent typically runs with SYSTEM privileges on Windows and root on Unix-like systems, files written outside the plugin directory inherit those privileges. Attackers can overwrite scheduled task definitions, service binaries, cron entries, or systemd unit files to achieve code execution on the next execution cycle.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The agent accepts a file path or archive entry name and joins it to the plugin directory without normalizing the result or rejecting traversal sequences. This allows the effective write target to resolve outside the plugin root.
Attack Vector
Exploitation requires network access to the Tenable Agent and high privileges on the management channel. An attacker with these prerequisites submits a crafted plugin update or file write operation containing traversal sequences in the target filename. The agent resolves the path and writes attacker-controlled content to a sensitive location on the host, which is then executed by an existing scheduled task, service, or interactive login.
No public proof-of-concept exploit code is available. Refer to the Tenable Security Advisory TNS-2026-18 for vendor-supplied technical details.
Detection Methods for CVE-2026-15265
Indicators of Compromise
- File creation or modification by the Tenable Agent process (nessusd, tenable-agent) outside the documented plugin directory.
- Unexpected writes to autorun locations such as Windows Startup folders, System32, /etc/cron.d/, /etc/systemd/system/, or user shell profiles originating from the agent process.
- Plugin update requests containing ..\, ../, or URL-encoded traversal sequences in filenames.
Detection Strategies
- Baseline the expected file write locations for the Tenable Agent and alert on writes outside that allowlist.
- Inspect agent logs for plugin download or install operations referencing filenames containing traversal characters.
- Correlate agent process activity with subsequent execution of newly created binaries or scripts to identify post-exploitation behavior.
Monitoring Recommendations
- Enable file integrity monitoring on operating system directories, service binaries, and scheduled task stores.
- Forward Tenable Agent logs to a central SIEM and retain them for at least 90 days for retrospective analysis.
- Track process lineage where the Tenable Agent spawns child processes, particularly shells, script interpreters, or unsigned binaries.
How to Mitigate CVE-2026-15265
Immediate Actions Required
- Upgrade Tenable Agent to a version released after security advisory TNS-2026-18.
- Inventory all endpoints running Tenable Agent 11.2.0 or 11.1.3 and earlier and prioritize patching servers and privileged workstations.
- Rotate credentials and API keys used by the Tenable Agent management channel if compromise is suspected.
Patch Information
Tenable released fixed agent builds in advisory TNS-2026-18. Apply the vendor-supplied updates through Tenable.io, Tenable.sc, or the manual installer package appropriate for each operating system. Verify the installed agent version after upgrade using nessuscli -v or the equivalent platform command.
Workarounds
- Restrict network access to the Tenable Agent management interfaces to trusted management hosts only.
- Enforce least privilege on accounts able to authenticate to the agent control channel and require multi-factor authentication where supported.
- Monitor and audit privileged operator accounts that can push plugin updates until patching is complete.
# Verify installed Tenable Agent version and confirm patched build
# Linux/macOS
/opt/nessus_agent/sbin/nessuscli -v
# Windows (PowerShell)
& "C:\Program Files\Tenable\Nessus Agent\nessuscli.exe" -v
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
