Stack-Based Buffer Overflow in Nessus NASL Processing

CVE-2026-81625 is a critical security vulnerability discovered in the Tenable Nessus vulnerability management platform. The vulnerability is located within the platform's NASL (Nessus Attack Scripting Language) processing engine. An attacker who has already obtained legitimate user-level access to the Nessus management console or environment can craft and upload a malicious or compromised NASL vulnerability test (VT) file. When the Nessus engine processes this specifically crafted script, it triggers a stack-based buffer overflow. This allows the attacker to bypass standard security controls and achieve full command execution on the underlying host operating system with the privileges of the service user. This vulnerability is significant because it allows for privilege escalation and persistent access within a security tool that often maintains high-level administrative credentials across an organization's network, representing a high-value target for lateral movement.

Impact

Successful exploitation of this vulnerability results in full system compromise of the Nessus server. If exploited, an attacker could gain complete control over the vulnerability scanner, allowing them to access stored credentials, scan history, and network topology data. Furthermore, an attacker could utilize the compromised Nessus instance as a platform to launch further attacks against the rest of the internal network, effectively weaponizing the security tool itself.

Recommendation

Prioritized actions for security teams using Nessus:

• Identify all users with permissions to upload or create custom NASL scripts and verify their activity logs for unauthorized or unexpected modifications.
• Patch Nessus installations to the latest version provided by Tenable to remediate CVE-2026-81625 immediately.
• Review access control policies for the Nessus management console to ensure the principle of least privilege is applied, specifically restricting the ability to upload or edit NASL files to trusted administrators only.
• Monitor application logs for segmentation faults or unexpected service restarts of the Nessus daemon, which may indicate attempted exploitation of the buffer overflow condition.