CVE-2026-15265: Tenable Agent path traversal in plugin directory

CVE-2026-15265 · Severity: critical · CVSS 9.1 · Published 2026-07-14

Tenable Agent, a software component used to monitor and assess the security of computers and servers, contains a vulnerability that could allow an attacker to take full control of a system. By exploiting a flaw in how the agent handles file paths, a high-privileged attacker can write malicious files to sensitive areas of the operating system. This could lead to remote code execution, potentially resulting in data theft, service disruption, or a complete compromise of the affected machine.

Vendors: Tenable.

Quick answers

Is CVE-2026-15265 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-15265 being exploited in the wild.
How severe is CVE-2026-15265?
Critical severity, with a CVSS score of 9.1, published 14 July 2026.
Which products and versions are affected?
Tenable Nessus Agent 11.2.0, 11.1.3 and lower.
Is there a fix for CVE-2026-15265?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15265 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-15265?
Check whether you run Tenable Nessus Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in Tenable Agent versions 11.2.0, 11.1.3, and earlier across Windows, Linux, and macOS platforms. The flaw stems from improper verification of cryptographic signatures (CWE-347) and inadequate path validation, allowing a high-privileged attacker to write arbitrary files outside of the designated plugin directory. While the attack requires high privileges, the vulnerability is reachable over the network and carries a high impact because it can lead to remote code execution (RCE) with a scope break (S:C). Users are advised to update to patched versions of the Tenable Agent.

Affected products

  • Tenable Tenable Agent 11.2.0, 11.1.3 and lower

Timeline

  • 2026-07-14: advisory: Initial publication of the vulnerability details.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.