Nessus Agent
Vendor:
First CVE: Sep 9, 2019 · Active for 6 years
16
Total CVEs
More Total CVEs than 92% of tracked products
2.3
Avg CVEs / Year
Higher CVE frequency than 73% of tracked products
7.4
Avg CVSS
Higher Avg CVSS than 48% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Nessus Agent over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 9, 2019
6 years ago
Most Recent CVE
Feb 13, 2026
161 days ago
CVE Severity & Scoring
Nessus Agent16 CVEs
38%
63%
All CVEs352,294 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local13 (81.3%)
Network3 (18.8%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low15 (93.8%)
High1 (6.3%)
Unknown0 (0.0%)
User Interaction
None13 (81.3%)
Unknown0 (0.0%)
Required3 (18.8%)
Privileges Required
Low10 (62.5%)
High4 (25.0%)
None2 (12.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (16 CVEs).
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-2026MEDIUM A vulnerability has been identified where weak file permissions in the Nessus Agent directory on Windows hosts could allow unauthorized access, potentially permitting Denial of Ser | Feb 13, 2026 | 6.1 | 35 | NO | NO |
CVE-2021-3450HIGH The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1. | Mar 25, 2021 | 7.4 | 34 | NO | NO |
CVE-2025-36640HIGH A vulnerability has been identified in the installation/uninstallation of the Nessus Agent Tray App on Windows Hosts which could lead to escalation of privileges. | Jan 13, 2026 | 8.8 | 31 | NO | NO |
CVE-2025-36633HIGH In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could arbitrarily delete local system files with SYSTEM privilege, potentia | Jun 13, 2025 | 7.8 | 24 | NO | NO |
CVE-2019-16168MEDIUM In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe divis | Sep 9, 2019 | 6.5 | 24 | NO | NO |
CVE-2025-36632HIGH In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege. | Jun 16, 2025 | 7.8 | 23 | NO | NO |
CVE-2025-24915HIGH When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permissions for sub-directories. This could | Mar 21, 2025 | 7.8 | 23 | NO | NO |
CVE-2024-3292HIGH A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus Agent host could modify installation parameters at installation time, which could l | May 17, 2024 | 8.2 | 23 | NO | NO |
CVE-2021-20118MEDIUM Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables o | Sep 9, 2021 | 6.7 | 22 | NO | NO |
CVE-2021-20117MEDIUM Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables o | Sep 9, 2021 | 6.7 | 22 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (16 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (16 CVEs).
Media Mentions
Signals from CVEs in this product scope (16 CVEs).
Top CNAs Publishing CVEs For Nessus Agent
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 8.1.0 | 1 | 7.8 | 0.4% | 0 | 0 |
| 8.0.0 | 1 | 7.8 | 0.4% | 0 | 0 |