CVE-2026-15265
Critical
Description
A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code execution.
SeverityCritical
CVSS9.1
Exploit probability—
ProductTenable Nessus Agent
PublishedJul 14, 2026
First seenJul 14, 2026
Weakness typeCWE-22Path traversalCWE-347CWE-347
How to fix
Update
- tenable nessus_agent11.1.4 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tenable nessus_agent | v < 11.1.4, 11.2.0 | 11.1.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.