Multiple SQL Injection Vulnerabilities in Tenable Nessus (CVE-2026-57587, CVE-2026-57588)

CERT-FR has issued an advisory regarding multiple SQL injection (SQLi) vulnerabilities, identified as CVE-2026-57587 and CVE-2026-57588, affecting Tenable Nessus versions prior to 10.12.0. These vulnerabilities, detailed in Tenable security bulletin tns-2026-17, enable an unauthenticated or authenticated attacker to inject malicious SQL queries into the application's database. While the advisory does not specify observed in-the-wild exploitation, the nature of SQL injection can lead to severe consequences, including data exfiltration, unauthorized modification of database content, and potentially remote code execution depending on the database configuration. Nessus, being a critical vulnerability scanning solution, makes its compromise particularly impactful for organizations relying on it for security assessments.

Attack Chain

1. An attacker identifies a vulnerable Tenable Nessus instance (version prior to 10.12.0) that is exposed and accessible.
2. The attacker crafts malicious input containing SQL metacharacters and queries, targeting specific application input fields, HTTP parameters, or API endpoints.
3. The Nessus application processes the malformed input without proper sanitization or parameterization.
4. The malicious SQL query is executed by the underlying database, allowing the attacker to bypass authentication, retrieve sensitive data from the database, or manipulate existing data.
5. Depending on the database and application configuration, the attacker might gain access to Nessus's configuration, scan results, user credentials, or even achieve remote code execution on the server hosting Nessus.
6. The attacker achieves their objective, which could range from unauthorized access to sensitive vulnerability data to full control over the Nessus instance and potentially internal network reconnaissance.

Impact

The successful exploitation of these SQL injection vulnerabilities in Tenable Nessus could lead to significant data breaches and operational disruption. An attacker could exfiltrate sensitive scan data, including details about an organization's vulnerabilities, configurations, and network topology, which could then be used for further targeted attacks. Compromise of the Nessus instance itself could also allow an attacker to launch scans against internal networks, effectively weaponizing the organization's own security tools. Given Nessus's role in security, a breach could undermine trust, compromise sensitive assets, and incur substantial regulatory fines and reputational damage.

Recommendation

• Prioritize patching Tenable Nessus to version 10.12.0 or higher immediately, as recommended by Tenable's security bulletin tns-2026-17.
• Review network segmentation and access controls for Tenable Nessus instances to ensure they are not unnecessarily exposed.
• Monitor logs for unusual activity on systems hosting Tenable Nessus, specifically looking for abnormal database queries or application errors that might indicate attempted exploitation of CVE-2026-57587 and CVE-2026-57588.