Tenable vulnerabilities
We track 47 vulnerabilities in Tenable products across 18 products. 46 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on October 8, 2026.
Latest Tenable vulnerabilities
- 9.9 Critical severity
Tenable Identity Exposure (SaaS): Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.
- 9.9 Critical severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.
- 9.9 Critical severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying ope
- 8.8 High severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.
- 8.8 High severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction.
- 8.1 High severity
Security Center: Incorrect Authorization
A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restricti
- 7.2 High severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are tri
- 9.9 Critical severity
Security Center: Improper Neutralization of Directives in Dynamically Evaluated Code
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-si
- 9.6 Critical severity
Sensor Proxy: Improper Control of Generation of Code
A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.
- 8.8 High severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.
- 7.1 High severity
Security Center: Improper Neutralization of Special Elements used in an SQL Command
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.
- 9.9 Critical severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.
- 9.9 Critical severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.
- 9.1 Critical severity
tenable_agent: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code execution.
- 7.5 High severity
Tenable Identity Exposure: Missing Authentication for Critical Functionality
Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated rem
- 8.6 High severity
Terrascan: Server-Side Request Forgery
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server mode. When Terrascan parses uploaded ARM templates or CloudFormation templates, it resolves external U
- 8.6 High severity
Terrascan: Server-Side Request Forgery
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) when running in server mode. An unauthenticated remote att
- 8.6 High severity
Terrascan: Server-Side Request Forgery
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan) when running in server mode. An unauthenticated remote attacker can s
- 7.8 High severity
Tenable Nessus, Tenable Nessus Agent: Improper Link Resolution Before File Access
This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to exec
- 8.8 High severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security Center is hosted.
- 8.8 High severity
Nessus Agent: Improper Privilege Management
A vulnerability has been identified in the installation/uninstallation of the Nessus Agent Tray App on Windows Hosts which could lead to escalation of privileges.
- 7.1 High severity
Nessus: Improper Privilege Management
In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
- 7.8 High severity
Agent: Improper Privilege Management
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could arbitrarily delete local system files with SYSTEM privilege, potentially leading to local privilege escalation.
- 7.8 High severity
Agent: Improper Privilege Management
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
- 7.8 High severity
Network Monitor: Improper Access Control
In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a local directory to run arbitrary code with SYSTEM privileges, potentially leading to local privilege escalation.
- 7.8 High severity
Network Monitor: Improper Access Control
When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions prior to 6.5.1 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secure
- 7.8 High severity
Nessus: Incorrect Default Permissions
When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-defa
- 7.8 High severity
Nessus Agent: Incorrect Default Permissions
When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in
- 8.2 High severity
Nessus Agent: Time-of-check Time-of-use (TOCTOU) Race Condition
A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus Agent host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host. - CVE-2024-3292
- 7.8 High severity
Nessus Agent: Improper Preservation of Permissions
When installing Nessus Agent to a directory outside of the default location on a Windows host, Nessus Agent versions prior to 10.6.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secure
- 8.2 High severity
Nessus: Time-of-check Time-of-use (TOCTOU) Race Condition
A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host
- 7.8 High severity
Nessus: Improper Preservation of Permissions
When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the direct
- 7.8 High severity
Nessus Agent: Improper Privilege Management
As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability could allow a malicious actor with sufficient permissions on a scan target to place a binary in a specific filesystem lo
- 7.3 High severity
Tenable Identity Exposure Secure Relay: Improper Neutralization of Special Elements used in an OS Command
A DLL injection vulnerability exists where an authenticated, low-privileged local attacker could modify application files on the TIE Secure Relay host, which could allow for overriding of the configuration and running of new Secure Relay services.
- 7.2 High severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host.
- 7.3 High severity
Nessus: Improper Privilege Management
Under certain conditions, a low privileged attacker could load a specially crafted file during installation or upgrade to escalate privileges on Windows and Linux hosts.
- 7.2 High severity
Under certain conditions, Nessus Network Monitor was found to not properly enforce input…
Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alter parameters that could potentially allow a blindSQL injection.
- 7.8 High severity
Nessus Network Monitor: Improper Control of Generation of Code
NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM is installed to a non-standard location
- 8.8 High severity
Nessus Network Monitor: Improper Privilege Management
Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows hosts by replacing a specially crafted file.
- 8.8 High severity
Tenable.io: Uncontrolled Search Path Element
Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: before Plugin Feed ID #202306261202 ; Security Center: before Plugin Feed ID #202306261202 . This vulnerab