CVE-2026-18667: Tenable Sensor Proxy RCE Vulnerability

CVE-2026-18667 Overview

CVE-2026-18667 is a critical code injection vulnerability [CWE-94] in Tenable Sensor Proxy. A remote attacker can execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host. The flaw requires no authentication and no user interaction on the vulnerable component itself, though it depends on an operator action to point the sensor at a malicious endpoint. Successful exploitation grants full compromise of the sensor proxy host with high impact to confidentiality, integrity, and availability.

Critical Impact
Remote attackers can achieve privileged code execution on Tenable Sensor Proxy deployments by tricking operators into connecting to an attacker-controlled host.

Affected Products

Tenable Sensor Proxy (see vendor advisory for affected versions)

Discovery Timeline

2026-08-03 - CVE-2026-18667 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-18667

Vulnerability Analysis

CVE-2026-18667 affects Tenable Sensor Proxy, a component that relays scan data between distributed sensors and Tenable management infrastructure. The vulnerability is classified under [CWE-94] Improper Control of Generation of Code, indicating that data from a remote host is incorporated into an execution context without sufficient validation.

When an operator connects the sensor proxy to a host controlled by an attacker, the attacker returns crafted data that the proxy processes as code. The proxy executes this content with the elevated privileges of the sensor service account. This produces a full compromise of the sensor host, exposing scan credentials, network topology data, and any secrets stored on the proxy.

The attack does not require authentication to the proxy itself. Instead, the trust boundary is violated at the point where the proxy establishes an outbound connection and accepts responses from the remote host as authoritative.

Root Cause

The root cause is improper handling of responses received from a connected upstream host. Tenable Sensor Proxy trusts data returned from the configured host and passes it to a component that interprets it as executable content. See the Tenable Security Advisory TNS-2026-21 for the technical description of the affected code paths.

Attack Vector

Exploitation follows a two-step social-engineering plus network attack pattern. The attacker stands up a malicious host that impersonates a legitimate Tenable service endpoint. The attacker then induces an operator, through phishing, misconfiguration guidance, or supply-chain manipulation of documentation, to configure the sensor proxy to connect to that host. Once the connection is established, the malicious server delivers a payload that the proxy executes with elevated privileges. No further operator interaction is required after the initial connection.

Technical details of the exploitation payload have not been publicly released. Refer to the Tenable Security Advisory TNS-2026-21 for vendor guidance.

Detection Methods for CVE-2026-18667

Indicators of Compromise

Outbound connections from Tenable Sensor Proxy hosts to unexpected or unapproved destinations outside the documented Tenable infrastructure ranges.
Configuration changes to the sensor proxy that redirect its upstream host to an unknown IP or hostname.
Unexpected child processes spawned by the sensor proxy service or writes to script and binary paths outside its normal working directories.
Anomalous outbound data volume or new listening ports on sensor proxy hosts following a configuration change.

Detection Strategies

Baseline the expected upstream destinations for each sensor proxy and alert on deviations.
Monitor process lineage from the sensor proxy service and flag execution of shells, interpreters, or download utilities.
Correlate operator configuration changes with subsequent outbound network activity to detect suspicious reconfiguration windows.

Monitoring Recommendations

Enable endpoint telemetry on sensor proxy hosts, including process creation, network connection, and file modification events.
Ingest sensor proxy application logs and Tenable audit events into a SIEM for correlation with network flow data.
Alert on any modification to the sensor proxy configuration file or service parameters outside change-management windows.

How to Mitigate CVE-2026-18667

Immediate Actions Required

Apply the fixed version of Tenable Sensor Proxy as described in the Tenable Security Advisory TNS-2026-21.
Audit all sensor proxy deployments to verify they are connected only to authorized Tenable infrastructure hosts.
Restrict operator permissions so that only vetted administrators can modify the sensor proxy upstream host configuration.
Review recent configuration changes and connection logs for any unauthorized redirection.

Patch Information

Tenable has published a fixed release. Consult the Tenable Security Advisory TNS-2026-21 for the specific fixed version numbers, upgrade instructions, and any prerequisite steps. Prioritize patching internet-facing or DMZ-hosted sensor proxies first, followed by internal deployments.

Workarounds

Enforce egress network controls that limit sensor proxy outbound connections to a strict allow-list of Tenable service endpoints.
Require change-control approval for any modification to sensor proxy upstream configuration.
Segment sensor proxy hosts on a dedicated management VLAN with restricted lateral movement paths.

bash

# Example egress allow-list enforcement (iptables)
# Replace <tenable-endpoint-ip> with the approved Tenable service address
iptables -A OUTPUT -o eth0 -p tcp -d <tenable-endpoint-ip> --dport 443 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -j LOG --log-prefix "SENSOR_PROXY_BLOCKED: "
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -j DROP