This vulnerability in Tenable Nessus and Nessus Agent arises from improper handling of symbolic links (junctions) before file access, classified as CWE-59. Exploiting this flaw allows an attacker with local privileges to create a junction that causes the software to delete arbitrary files with SYSTEM-level privileges. This can potentially lead to arbitrary code execution under SYSTEM context. The CVSS 4.0 vector indicates local attack vector, low attack complexity, required user interaction, and privileges required at the local level. The vulnerability is published and assigned CVE-2026-33694 but lacks an official remediation level or patch information from Tenable.

Successful exploitation allows an attacker with local access to delete arbitrary files with SYSTEM privileges, which may lead to arbitrary code execution with SYSTEM-level rights. This elevates the attacker's privileges significantly, potentially compromising the affected system's integrity and security. However, exploitation requires local access and user interaction, limiting remote attack feasibility. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local user privileges to trusted users only and monitor for suspicious local activity. Avoid executing untrusted code or opening untrusted files that could trigger this vulnerability. Follow Tenable's official communications for updates on patches or mitigations.