Is CVE-2026-103946 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103946 being exploited in the wild.

How severe is CVE-2026-103946?

High severity, with a CVSS score of 8.3, published 14 October 2026.

Which products and versions are affected?

Tenable Nessus versions prior to 10.12.5.

Is there a fix for CVE-2026-103946?

Yes: fixed in Nessus 10.12.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103946 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-103946?

Check whether you run Tenable Nessus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103946: Tenable Nessus SQL injection vulnerability

CVE-2026-103946 · Severity: high · CVSS 8.3 · Published 2026-10-14

Nessus is a widely-used vulnerability scanner that organizations rely on to identify security risks in their networks. An authenticated user can exploit an SQL injection flaw to read or modify the scan data and configurations stored in Nessus, potentially exposing sensitive information about an organization's infrastructure or allowing an attacker to manipulate scan results to hide evidence of compromise.

Technologies: Tenable Nessus. Vendors: Tenable.

Quick answers

Is CVE-2026-103946 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103946 being exploited in the wild.
How severe is CVE-2026-103946?: High severity, with a CVSS score of 8.3, published 14 October 2026.
Which products and versions are affected?: Tenable Nessus versions prior to 10.12.5.
Is there a fix for CVE-2026-103946?: Yes: fixed in Nessus 10.12.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103946 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-103946?: Check whether you run Tenable Nessus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Nessus 10.12.5

Technical details

An SQL injection vulnerability in Nessus allows authenticated users to inject malicious SQL queries, gaining unauthorized access to the database. The flaw requires network access and valid authentication credentials, but no additional user interaction. An attacker can read sensitive scan data, modify stored information, or potentially escalate privileges depending on database permissions.

Affected products

Tenable Nessus versions prior to 10.12.5

Timeline

2026-10-14: disclosed

References

https://www.tenable.com/security/tns-2026-26

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.