Home

Description

A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code execution.

PUBLISHED Reserved 2026-07-09 | Published 2026-07-14 | Updated 2026-07-14 | Assigner tenable




CRITICAL: 9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:F/RL:U/RC:C
CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Problem types

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Improper Verification of Cryptographic Signature

Product status

11.2.0
affected

Any version
affected

Credits

Neil Graves / LVL 0x00, LLC reporter

References

www.tenable.com/security/tns-2026-18 (TNS-2026-18) vendor-advisory

cve.org (CVE-2026-15265)

nvd.nist.gov (CVE-2026-15265)

Download JSON