# CVE-2026-119317: Tenable Nessus arbitrary file read via Unix compliance audit

Source: https://junglewise.ai/threats/cve-2026-119317-on-linux-an-authenticated-low-privileged-nessus-user-with-scan  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-119317 · Severity: medium · CVSS 6.5 · Published 2026-10-29

Nessus is a vulnerability scanner used by organizations to identify security weaknesses. An authenticated low-privileged user with permission to create scans could exploit this flaw to read any text file on the scanner host, potentially exposing sensitive configuration data or credentials. The attacker runs a custom Unix compliance audit targeting the scanner itself to gain elevated read access.

Technologies: [Tenable Nessus](https://junglewise.ai/threats/technologies/nessus). Vendors: [Tenable](https://junglewise.ai/threats/vendors/tenable).

## Quick answers

**Is CVE-2026-119317 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119317 being exploited in the wild.

**How severe is CVE-2026-119317?** Medium severity, with a CVSS score of 6.5, published 29 October 2026.

**Which products and versions are affected?** Tenable Nessus Linux versions prior to plugin feed serial #202610282338.

**Is there a fix for CVE-2026-119317?** Yes: fixed in Plugin feed serial #202610282338 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119317 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119317?** Check whether you run Tenable Nessus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Plugin feed serial #202610282338 and later

## Technical details

A malicious Unix compliance audit created by an authenticated, low-privileged Nessus user can be leveraged to read arbitrary text files on the scanner host with the privileges of the nessusd process. This is an authorization bypass (CWE-863) affecting the compliance audit feature on Linux systems. The attack requires scan-creation privileges but no elevated user role, and exploitation leaves no indication of being exploited in the wild at the time of disclosure.

## Affected products

- Tenable Nessus Linux versions prior to plugin feed serial #202610282338

## Timeline

- 2026-10-28: disclosed
- 2026-10-28: advisory
- 2026-10-28: patched: Plugin feed update released

## References

- [https://www.tenable.com/security/tns-2026-33](https://www.tenable.com/security/tns-2026-33)

## Related threats

- [Tenable Nessus SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-103946-an-sql-injection-vulnerability-could-allow-an-authenticated-user)
- [Tenable Nessus SQL injection in scan result import](https://junglewise.ai/threats/cve-2026-57588-tenable-nessus-sql-injection-in-scan-result-import)
- [Tenable Nessus SQL injection via reverse DNS records](https://junglewise.ai/threats/cve-2026-57587-tenable-nessus-sql-injection-via-reverse-dns-records)
- [This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM…](https://junglewise.ai/threats/cve-2026-33694-this-vulnerability-allows-an-attacker-to-create-a-junction)
- [Moment.js ReDoS in duration function](https://junglewise.ai/threats/cve-2016-4055-moment-js-redos-in-duration-function)