CVE-2026-15265CWE-22CWE-347path-traversal

CVE-2026-15265

Critical · published July 14, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
45.7
In the wild
Unconfirmed
What it is

A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code execution.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00557 · 45.7th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-07-14T19:16Z
Affected products (2)
ProductVersionsFixed in
tenable/nessus_agent< 11.1.411.1.4
tenable/nessus_agentall versions—
References (1)
https://www.tenable.com/security/tns-2026-18 · [email protected]
EPSS history
Timeline
  • 14 JUL 15:02Z
    Tenable Agent Path Traversal Leading to Remote Code Execution
    cvelistv5