CVE-2026-15265 PUBLISHED

Tenable Agent Path Traversal Leading to Remote Code Execution

Assigner: tenable
Reserved: 09.07.2026 Published: 14.07.2026 Updated: 14.07.2026

A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code execution.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:F/RL:U/RC:C
CVSS Score: 9.1

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	None	Availability	High	Availability	High
Privileges Required	High
User Interaction	None

CVSS 4.0

Product Status

Vendor	tenable
Product	tenable_agent
Versions	Version 11.2.0 is affected affected from 0 to 11.1.3 (incl.)

Credits

Neil Graves / LVL 0x00, LLC reporter

References

TNS-2026-18

Problem Types

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE
Improper Verification of Cryptographic Signature CWE