# CVE-2026-15265: Tenable Agent path traversal in plugin directory

Source: https://junglewise.ai/threats/cve-2026-15265-tenable-agent-path-traversal-in-plugin-directory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-15265 · Severity: critical · CVSS 9.1 · Published 2026-07-14

Tenable Agent, a software component used to monitor and assess the security of computers and servers, contains a vulnerability that could allow an attacker to take full control of a system. By exploiting a flaw in how the agent handles file paths, a high-privileged attacker can write malicious files to sensitive areas of the operating system. This could lead to remote code execution, potentially resulting in data theft, service disruption, or a complete compromise of the affected machine.

Vendors: [Tenable](https://junglewise.ai/threats/vendors/tenable).

## Quick answers

**Is CVE-2026-15265 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15265 being exploited in the wild.

**How severe is CVE-2026-15265?** Critical severity, with a CVSS score of 9.1, published 14 July 2026.

**Which products and versions are affected?** Tenable Nessus Agent 11.2.0, 11.1.3 and lower.

**Is there a fix for CVE-2026-15265?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15265 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15265?** Check whether you run Tenable Nessus Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in Tenable Agent versions 11.2.0, 11.1.3, and earlier across Windows, Linux, and macOS platforms. The flaw stems from improper verification of cryptographic signatures (CWE-347) and inadequate path validation, allowing a high-privileged attacker to write arbitrary files outside of the designated plugin directory. While the attack requires high privileges, the vulnerability is reachable over the network and carries a high impact because it can lead to remote code execution (RCE) with a scope break (S:C). Users are advised to update to patched versions of the Tenable Agent.

## Affected products

- Tenable Tenable Agent 11.2.0, 11.1.3 and lower

## Timeline

- 2026-07-14: advisory: Initial publication of the vulnerability details.

## References

- [https://www.tenable.com/security/tns-2026-18](https://www.tenable.com/security/tns-2026-18)

## Related threats

- [This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM…](https://junglewise.ai/threats/cve-2026-33694-this-vulnerability-allows-an-attacker-to-create-a-junction)