CVE-2026-103946: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in Tenable, Inc. Nessus

This vulnerability is classified as CWE-89, indicating improper neutralization of special elements used in an SQL command (SQL injection). It affects Nessus versions from initial releases up to but not including 10.12.5. An authenticated user could exploit this flaw to read or modify the data stored by the Nessus application, potentially compromising the integrity and confidentiality of stored information. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, with high impact on confidentiality and integrity, and low impact on availability.

An attacker with authentication privileges could leverage this SQL injection vulnerability to access or alter sensitive data within the Nessus database. This could lead to unauthorized disclosure or modification of scan data or configuration information, impacting the trustworthiness and security of the Nessus environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Tenable's advisories for updates and consider restricting authenticated user privileges to minimize risk until a fix is available.