Executive brief
Nessus is a widely used vulnerability scanner that helps organizations identify security weaknesses in their networks. A flaw has been identified where an attacker who controls the naming records (reverse DNS) of a scanned computer can inject malicious code into the Nessus database. This could allow the attacker to steal sensitive information from previous scan results, potentially exposing the security posture of other systems on the network.
Technical details
A SQL injection vulnerability (CWE-89) exists in Tenable Nessus due to improper neutralization of special elements in reverse DNS records during the scanning process. An unauthenticated remote attacker can exploit this by controlling the PTR records for a host being scanned by a Nessus instance. When Nessus performs a scan and resolves the hostname, the malicious record is processed and injected into the underlying scan results database. Successful exploitation could enable the attacker to exfiltrate sensitive scan-result data. The vulnerability is addressed in Nessus version 10.12.1.
Affected products
- Tenable Nessus < 10.12.1
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory