Tenable Nessus security vulnerabilities: Attackers can overwrite system data

Attackers can exploit three security vulnerabilities in Tenable Nessus and attack systems. In the worst case, attackers can overwrite system files under Windows. So far, there are no reports of ongoing attacks. Admins should install the secure version as soon as possible.

Several dangers

In a warning message, the developers explain that two vulnerabilities (CVE-2025-6021 “high”, CVE-2025-24855 “high”) affect the libxml2 and libxslt components. In both cases, attackers can trigger memory errors, which leads to a DoS state. In such a case, crashes occur. However, malicious code can often also reach systems in the context of memory errors. It is currently unclear how such an attack could take place.

The third vulnerability (CVE-2025-36630 “high”) impacts the vulnerability and network scanner code directly. At this point, attackers can overwrite system files with system rights as non-administrative users. It remains unclear which parameters admins can use to recognize attacks that have already taken place.

Security patch is available

The developers assure us that they have solved the problems in Nessus 10.8.5 and Nessus 10.9.0. All previous versions are vulnerable. As a safeguard, they have implemented the patched versions libxml2 2.13.8 and liubxslt 11.1.43. According to Tenable, all vulnerabilities have been known since May of this year. The security update and the warning message have only now been published.

The developers only recently closed several security gaps in Tenable Agent. In this context, malicious code can get onto PCs and completely compromise systems.

(des)