CVE-2026-103946

Executive Summary

CVE-2026-103946 is an SQL injection vulnerability (CWE-89) in Nessus that allows an authenticated user to read or modify data stored by the product. The flaw carries a CVSS 3.1 base score of 8.3 with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, meaning it is network-reachable, low-complexity, requires only low privileges, and yields high confidentiality and integrity impact. Because exploitation requires a valid authenticated account, the primary risk is to organizations that grant Nessus access to multiple operators, delegated scanning users, or integrated service accounts; no public proof-of-concept, exploit code, or Nuclei template is currently available.

Technical Analysis

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command — "SQL Injection"). The NVD description states plainly: "An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus." That is the full extent of the technical detail published in the available intelligence feed. No CNA title, no affected version range, no patch reference, and no vendor advisory have been provided.

From the vulnerability class alone, the following can be stated with confidence without fabricating implementation specifics:

• Attack surface: The vulnerable component is Nessus, an application that exposes network services (historically a web management interface on TCP 8834). The CVSS vector confirms network reachability (AV:N) and a low-privilege authenticated precondition (PR:L). This indicates the injection point is reachable after authentication, not in a pre-auth code path.
• Mechanism class: An SQL injection occurs when user-supplied input is concatenated or interpolated into a database query without parameterization or adequate escaping. In this case, because the precondition is an authenticated user, the injectable parameter is most plausibly associated with a feature that persists or retrieves data on behalf of that user — for example a search, filter, reporting, or configuration field backed by a SQL datastore.
• Scope and impact mapping: The CVSS subscores map directly to the description. C:H corresponds to the stated ability to "read" data; I:H corresponds to the stated ability to "modify" data; A:L indicates a limited availability effect, consistent with an attacker being able to corrupt or remove some records rather than take down the entire service. S:U means the compromise does not escape the Nessus security authority.
• Why authentication matters: PR:L combined with no required user interaction (UI:N) implies a low-friction attack for anyone holding a valid low-privileged account — an insider, a contractor, a shared scanning account, or an attacker who has already obtained credentials through unrelated means.

Explicitly noted: no function names, endpoint paths, parameter names, or database table names are present in the supplied data, and none are asserted here. Any claim about which specific field is injectable would be speculation and is therefore omitted.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE as of the data provided. The following attack chain is inferred strictly from the vulnerability class and the CVSS precondition, and is described at the class level without inventing implementation details.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Nessus instance. The CVSS vector (AV:N) indicates the instance must be network-reachable. Open-source reconnaissance can locate management interfaces using the Shodan dorks in the METADATA block (for example http.title:"Nessus"). T1190 (Exploit Public-Facing Application) fits this stage where the instance is internet-exposed.

2. Credential acquisition. Because the vulnerability requires authentication (PR:L), the attacker must hold a valid low-privileged account. This could be obtained via legitimate provisioning, credential reuse, prior phishing, password spraying against the login surface, or a leaked/shared operator account. The attacker does not need administrative rights.

3. Injection trigger. Once authenticated, the attacker locates a feature within Nessus that accepts user input and forwards it to a backend database query without safe parameterization. At the class level, this means submitting crafted input containing SQL metacharacters (for example quote characters, boolean expressions, or UNION/SELECT constructs) into that parameter. A successful response that differs from a benign baseline — extra rows, altered results, error output, or timing differences — confirms the injection.

4. Payload objective (class level). Two outcomes are described by the vendor: reading data stored by Nessus, or modifying it. Read access could expose scanner configuration, results, credentials held for authenticated scanning, or user records. Write access could alter, corrupt, or delete stored records, consistent with the A:L availability subscore.

5. Post-exploitation impact. The scope remains unchanged (S:U), so the blast radius is confined to the Nessus application's own data and security authority. The attacker does not, by virtue of this CVE alone, obtain operating-system-level command execution. The realistic worst case is full control over the confidentiality and integrity of Nessus's stored data plus partial destruction of it.

Assumptions are flagged: the exact injectable parameter, the backend database engine, and the precise privilege tier required are all unknown from the provided description. No specific code patterns or hypothetical function names are asserted.

Impact Assessment

• Confidentiality (C:H): High. An authenticated low-privileged attacker can read data stored by Nessus. Depending on the records retained, this could include scan results, target inventories, and — critically for a vulnerability scanner — stored credentials used for authenticated scanning. That data enables lateral movement and follow-on targeting.
• Integrity (I:H): High. The attacker can modify stored data, undermining the trustworthiness of scan results, reports, and configuration. A tampered scanner can hide real vulnerabilities from operators or generate false findings.
• Availability (A:L): Low. Consistent with limited destruction of records rather than service-wide outage.
• Privileges required (PR:L) and attack complexity (AC:L): Low privilege and low complexity lower the barrier considerably. No user interaction is needed (UI:N).
• Scope (S:U): Unchanged; impact is contained within Nessus's security authority.
• Blast radius: Every deployment of Nesuss where multiple operators, delegated users, or third-party integrations authenticate to the platform. Environments that expose the management interface to untrusted networks carry the greatest exposure.
• Business impact: Nessus is widely used as the source of truth for vulnerability management. Compromise of its stored data can silently degrade an organization's entire scanning program — the highest-order risk here is not immediate data theft but poisoned assurance. Regulated environments that rely on scan evidence for compliance attestation face audit and reporting consequences.

Detection Guidance

Detection should focus on (a) SQL-injection patterns in requests to the Nessus management interface and (b) anomalous authenticated activity against Nessus data stores. Because the injectable parameter is unknown, the rules below are intentionally generic and keyed to the class-level behavior of SQLi against a web management surface.

Sigma Rule

title: Potential SQL Injection Attempt Against Nessus Management Interface
id: 6b1f9c2e-4a7d-4e21-9c3a-0d5e8f1a2b34
status: experimental
description: Detects SQL metacharacter patterns in HTTP requests to Nessus management endpoints, consistent with CVE-2026-103946 (CWE-89).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103946
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: nessus
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_uri:
    cs-uri-stem|contains:
      - '/'
  selection_payload:
    cs-uri-query|contains:
      - 'UNION SELECT'
      - 'OR 1=1'
      - "' OR '"
      - ';--'
      - 'SLEEP('
      - 'BENCHMARK('
      - 'WAITFOR DELAY'
      - 'information_schema'
      - 'EXTRACTVALUE('
      - 'UPDATEXML('
  condition: selection_method and selection_payload
falsepositives:
  - Legitimate application input containing SQL-like strings
  - Security scanners testing the platform itself
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-103946
  - cwe.89

YARA Rule

rule CVE_2026_103946_Nessus_SQLi_Indicators
{
    meta:
        description = "Class-level YARA heuristic for SQL injection artifacts targeting Nessus (CVE-2026-103946, CWE-89)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103946"
        severity = "high"

    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "' OR '" nocase
        $sqli4 = "information_schema" nocase
        $sqli5 = "WAITFOR DELAY" nocase
        $sqli6 = "SLEEP(" nocase
        $sqli7 = "BENCHMARK(" nocase
        $sqli8 = "EXTRACTVALUE(" nocase
        $sqli9 = "UPDATEXML(" nocase
        $nessus = "Nessus" nocase

    condition:
        $nessus and 2 of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any 8834 (
    msg:"CVE-2026-103946 Possible SQL Injection Against Nessus Management Interface";
    flow:established,to_server;
    http.method; content:"GET"; nocase;
    http.uri; content:"?"; 
    pcre:"/(UNION(\s|\+|%20)+SELECT|OR(\s|\+|%20)+1%3D1|%27%20OR%20%27|information_schema|WAITFOR(\s|\+|%20)+DELAY|SLEEP\(|BENCHMARK\()/Ui";
    classtype:web-application-attack;
    reference:cve,2026-103946;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-103946;
    sid:2026103946;
    rev:1;
    metadata:created_at 2026_01_01, cve CVE-2026-103946, cwe CWE-89;
)

Note: port 8834 is Nessus's conventional management port; tune the destination port and add a matching POST/body rule to fit the deployment.

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.protocol == "http" and
      url.path contains "nessus" and
      url.query regex~ "(?i)(union.*select|or\\s+1=1|information_schema|sleep\\(|benchmark\\(|waitfor\\s+delay)" ]
  [ network where network.protocol == "http" and
      http.response.status_code >= 500 ]

If EDR telemetry is available on the Nessus host, pivot on the scanner process spawning database clients or reading database files, correlating with the same source IP.

Splunk SPL Query

index=web OR index=proxy
(sourcetype=access_combined OR sourcetype=bluecoat:proxysg:access:*)
(dest_port=8834 OR url="*/nessus*")
| eval sqli_sig=if(match(lower(url),"(union(\s|%20|\+)+select|or(\s|%20|\+)+1=1|information_schema|sleep\(|benchmark\(|waitfor(\s|%20|\+)+delay|extractvalue\(|updatexml\()"),1,0)
| where sqli_sig=1
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls by src_ip, dest_ip, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,sqli,cve_2026_103946,">
  <rule id="100946" level="12">
    <if_sid>31100</if_sid>
    <id>^8834$</id>
    <regex>UNION(\s|%20|\+)+SELECT|OR(\s|%20|\+)+1=1|information_schema|SLEEP\(|BENCHMARK\(|WAITFOR(\s|%20|\+)+DELAY|EXTRACTVALUE\(|UPDATEXML\(</regex>
    <description>CVE-2026-103946: Possible SQL injection attempt against Nessus management interface from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,cwe_89,</group>
  </rule>
</group>

Note: rule ID 31100 is Wazuh's generic web-accesslog parent; tune the <id> field to match the deployed Nessus port and the parent rule to your log source.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data is available. The actions below are risk-reduction measures that do not depend on a specific patch being published.

1. Immediate mitigations.

   • Do not expose the Nessus management interface to untrusted networks. Restrict access to a management VLAN and enforce an explicit allowlist of operator IPs at the firewall or reverse proxy.
   • Reduce the population of authenticated accounts to the minimum necessary. Apply least privilege so that no user holds more Nessus permissions than their role requires (this directly raises the PR:L bar).
   • Enforce strong, unique credentials and MFA on all Nessus accounts; rotate any shared or service-account credentials.
   • Place the management interface behind an authenticating reverse proxy and enable request inspection/WAF in front of it where possible.
   • Validate the integrity of scan results and configuration snapshots on a schedule so that illicit "modification of data stored by Nessus" is detectable even without a patch.

2. Patch/upgrade steps.

   • Monitor the vendor's security advisory channel continuously and apply the vendor-supplied fix as soon as it is published; no fixed version is currently identified in tracked sources.
   • When a patch is released, inventory every Nessus instance (including agents, scanners, and manager nodes) and upgrade to the fixed build. Verify the running version after upgrade rather than trusting the deployment tool's report.
   • Back up Nessus configuration and data stores before upgrading so that post-patch integrity comparison is possible.

3. Long-term hardening.

   • Segment and isolate security tooling. Vulnerability scanners hold sensitive scanning credentials and should not sit on the same network plane as general user workstations or the internet.
   • Adopt parameterized queries / prepared statements as a coding standard for any in-house integration or plugin that talks to the Nessus data store (direct CWE-89 root-cause control).
   • Maintain continuous monitoring for SQLi patterns (see Detection Guidance) and alert on any authenticated account performing abnormal bulk reads or writes of Nessus data.
   • Conduct periodic access reviews of Nessus operators and service accounts, and integrate the scanner's audit logs into the SIEM.
   • Track CVEs for Nessus via an authoritative feed and set an escalation policy for high-CVSS flaws lacking a patch, given this CVE's 0/4 patch confidence.

References

• NVD — CVE-2026-103946: https://nvd.nist.gov/vuln/detail/CVE-2026-103946
• MITRE CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
• FIRST EPSS — no score published for this CVE as of this report: https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed in KEV as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No threat actor campaign, exploit-in-the-wild evidence, public PoC, exploit code, or Nuclei template has been observed for CVE-2026-103946 in the available data.