Nessus Linux scanner arbitrary file read via custom Unix audit (auth lowpriv)
CVE-2026-119317 Published on October 29, 2026
Incorrect Authorization
On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself.
Vulnerability Analysis
CVE-2026-119317 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-119317 has been classified to as an Authorization vulnerability or weakness.
Affected Versions
Tenable, Inc. Plugin Feed:- Before 202610282338 is affected.