Listen to this Post
CVE-2026-33694 is a high-severity vulnerability discovered in Tenable Nessus and Nessus Agent running on Microsoft Windows operating systems. The flaw resides in how the Nessus software handles file system paths before performing file access operations, specifically failing to properly validate or restrict links that resolve to unintended resources—a weakness classified under CWE-59 (Improper Link Resolution Before File Access).
At its core, the vulnerability allows an authenticated, low-privileged attacker to create a malicious NTFS junction (a type of reparse point that acts as a directory link) on the local system. Because the Nessus service and its associated processes routinely operate with the highest possible Windows privilege level—NT AUTHORITY\SYSTEM—any file operation performed by these processes inherits that elevated privilege. The attacker, who already possesses local access and low-level credentials, can set up a junction that points a directory path used by Nessus to an arbitrary target location on the file system.
When the Nessus Agent or Nessus scanner subsequently performs a file deletion operation on that path—for example, during routine cleanup, log rotation, update routines, or temporary file management—the software follows the junction link without proper verification. Instead of deleting the intended file within the Nessus working directory, the SYSTEM-privileged process inadvertently deletes the file or directory at the attacker-chosen target location. This could be a critical system file, a security control binary, a registry hive, or any other file accessible to the SYSTEM account.
The impact of this arbitrary file deletion is severe. Deleting a critical system file can cause denial of service, system instability, or force a reboot into recovery mode. More dangerously, an attacker can leverage this capability to delete security-related files (such as antivirus signatures, endpoint detection agents, or system libraries) and then replace them with malicious counterparts, ultimately achieving arbitrary code execution with full SYSTEM privileges. This effectively grants the attacker complete control over the affected Windows host, allowing for persistence establishment, defense evasion, data exfiltration, and lateral movement within the network.
The attack vector is local, meaning the attacker must already have authenticated access to the target system. The attack complexity is low, and no special attack requirements beyond the ability to create a junction are needed. However, the vulnerability does require some user interaction, as the Nessus process must be triggered to perform the file operation that follows the malicious junction. Tenable has acknowledged the issue and released patches, with the vulnerability being publicly disclosed on April 23, 2026.
DailyCVE Form:
Platform: Windows
Version: Nessus ≤10.11.3 / Agent ≤11.1.2
Vulnerability: Link Following (CWE-59)
Severity: High (CVSS 8.2)
Date: 2026-04-23
Prediction: Patch already available (2026-04-23)
What Undercode Say:
Check Nessus Agent version (Windows) wmic product where "name like 'Tenable Nessus Agent%%'" get version Check Nessus Scanner version Navigate to Nessus installation directory (default: C:\Program Files\Tenable\Nessus) Check the version in the 'nessusd' file properties or use: "C:\Program Files\Tenable\Nessus\nessuscli.exe" version Verify if system is vulnerable (Nessus Agent < 11.1.3) Example: if version is 11.1.2 or lower, system is vulnerable List existing junctions in a directory (check for suspicious links) dir /AL /S C:\ProgramData\Tenable Find all reparse points (junctions) on the system fsutil reparsepoint query C:\ Monitor for junction creation events (requires audit policy) Enable auditing: Audit File System, Audit Handle Manipulation Look for Event ID 4656 (Handle to a file system object requested) with reparse point operations
Exploit (Educational Purposes!):
The exploitation process would involve the following conceptual steps (purely for educational understanding):
1. Identify a writable directory that the Nessus service accesses with SYSTEM privileges (e.g., `C:\ProgramData\Tenable\Nessus Agent\var\nessus\logs` or temporary update directories).
2. Create a malicious junction pointing from a subdirectory within that Nessus-accessible path to a target system file. For example:
Create a junction from a Nessus log directory to the Windows SAM file mklink /J "C:\ProgramData\Tenable\Nessus Agent\var\nessus\logs\evil" "C:\Windows\System32\config\SAM"
3. Trigger a Nessus operation that causes the service to delete the contents of the logs directory (or a specific file within it). The Nessus service, running as SYSTEM, will follow the junction and delete the target file (SAM) instead.
4. Leverage the deletion to disrupt system authentication or replace the deleted file with a malicious version to achieve code execution with SYSTEM privileges.
Note: No public proof-of-concept exploit code has been released as of the latest updates. This description is provided solely for defensive understanding and security research purposes.
Protection:
- Immediate Patching: Upgrade Tenable Nessus to version 10.11.4 or 10.12.0, and Nessus Agent to version 11.1.3 or later. This is the primary and most effective mitigation.
- Restrict Local Access: Limit local login and interactive access to affected Windows hosts to only trusted administrators and operators, as exploitation requires authenticated local access.
- Disable Junction Creation for Non-Privileged Users: Implement Group Policy or security templates to restrict the ability of standard users to create reparse points (junctions) on system drives. This can be achieved by setting appropriate permissions on the `SeCreateSymbolicLinkPrivilege` or using Windows Defender Application Control (WDAC) policies.
- Monitor for Anomalous Activity: Enable auditing for file system and handle manipulation events. Monitor for the creation of new junctions in directories associated with Nessus, and watch for unexpected file deletions performed by the `nessusd.exe` or `nessus-agent.exe` processes.
- Least Privilege Principle: Where possible, run Nessus services with the minimum required privileges, though this may not be feasible due to the nature of vulnerability scanning.
Impact:
Successful exploitation of CVE-2026-33694 allows an authenticated attacker with low privileges to delete arbitrary files on the affected Windows system with SYSTEM-level permissions. This can lead to:
– System Instability and Denial of Service: Deleting critical operating system files, drivers, or boot configuration data can render the system unbootable or unstable.
– Elevation of Privilege: By deleting security-related binaries (e.g., antivirus, EDR agents, system libraries) and replacing them with malicious versions, the attacker can achieve arbitrary code execution with SYSTEM privileges.
– Full System Compromise: With SYSTEM-level code execution, the attacker gains complete control over the host, enabling persistence mechanisms, credential theft, lateral movement, and further attacks within the enterprise network.
– Circumvention of Security Controls: The vulnerability can be used to disable or bypass security monitoring tools, making detection and incident response significantly more difficult.
Given that Nessus is a widely deployed vulnerability management tool, often installed on critical infrastructure and domain controllers, the real-world impact of this vulnerability is substantial. Organizations should prioritize patching and treat any affected systems as potentially compromised.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
