Remote arbitrary code execution affecting Tenable Sensor Proxy
A critical vulnerability affecting Tenable Sensor Proxy would allow a malicious actor to remotely execute arbitrary code with elevated privileges on affected systems.
Description
Technical context and vulnerability details
Tenable Sensor Proxy is a tool that serves as a cache and single point of passage for network traffic between Tenable sensors (Nessus agents and scanners) and management platforms. It helps reduce bandwidth and optimize updates. This tool is affected by a vulnerability, labeled CVE-2026-18667, allowing a malicious actor to execute arbitrary code remotely with elevated privileges by tricking an operator into connecting a sensor to a host controlled by the attacker. Once the connection is established, the attacker can gain code execution on the system hosting Tenable Sensor Proxy, with elevated privileges, leading to complete system compromise. It is classified critical, with a severity score of 9.3 according to CVSS v4.0.
Potential Risks & Impact
Potential consequences upon exploitation
- Data privacy breach;
- Data integrity breach;
- Executing arbitrary code with elevated privileges;
Affected systems
Products, components and targeted versions
- All versions prior to version 1.4.2;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Immediately update Tenable Sensor Proxy to version 1.4.2 or any later patched version;
- Verify and control the systems to which Sensor Proxy sensors are connected;
- Apply the principle of least privilege on systems hosting Sensor Proxy;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.