CVE-2026-18667

Executive Summary

CVE-2026-18667 is a critical code injection vulnerability (CWE-94) in Tenable Sensor Proxy versions prior to 1.4.2. A remote unauthenticated attacker can achieve arbitrary code execution with elevated privileges by luring an operator (via social engineering) into connecting a Tenable Sensor to an attacker-controlled host. The CVSS score of 9.6 with a Scope change to "Changed" reflects that the compromise extends beyond the vulnerable component into the broader sensor/scanning infrastructure. Successful exploitation could result in full compromise of Tenable-managed scanning infrastructure, data exfiltration of scan results and credentials, and lateral movement into enterprise environments that trust the compromised sensor.

Technical Analysis

The vulnerability resides in the Tenable Sensor Proxy component, which acts as a communication relay between Tenable sensors and the Tenable product platform. The NVD description characterizes the flaw as enabling a remote attacker to "execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host." This mechanism is consistent with CWE-94 (Improper Control of Generation of Code), indicating the application fails to properly validate or sanitize input that is subsequently interpreted as code.

The attack surface is the operator-initiated connection workflow. The sensor proxy likely uses a configuration or registration handshake in which the sensor contacts a host designated by an operator. When the operator is directed (through phishing, or a substitute-in-the-middle attack on documentation, or a malicious README in a CI/CD pipeline) to configure the sensor to point to an attacker-controlled endpoint, the attacker can respond with crafted payloads that the sensor proxy processes without sufficient validation. Because the flaw allows code execution with elevated privileges, the proxy component likely runs with system-level or service-account privileges by default, and the injection vector is processed before privilege reduction or sandboxing.

The remote attacker component (AV:N) means the actual exploit can be launched from anywhere on the network — the attacker does not need local access. The UI:R requirement reflects that human interaction (the operator wiring the sensor to the rogue host) is necessary. The AC:L indicates no special conditions are needed beyond that operator action. The H/I:H and H/A:H reflect that this code execution is privileged and can alter both integrity and availability of the proxy host and the sensors connected to it.

Given that the CNA title indicates "Sensor Proxy Version 1.4.2 Fixes One Vulnerability," the fix appears to address this single flaw specifically, a process likely involving stricter input validation and the introduction of cryptographic authentication for the sensor-to-proxy handshake. No technical details (function names, specific protocols, or ports) are provided in the NVD description, so such specifics must be obtained from Tenable's private advisories or reverse engineering of the patch diff.

Exploitation Scenarios

While the NVD description is high-level, the attack chain can be reconstructed from the vulnerability class and the described mechanism:

Step 1 — Reconnaissance & Target Identification: The attacker must first identify a target organization that uses Tenable sensors (e.g., Tenable.io, Tenable.sc, or Nessus agents using sensor proxies). Publicly accessible sensor proxy dashboards or misconfigured instances may be discoverable via Shodan or Censys using the dorks listed above. More commonly, the attacker targets the operators of these sensors — DevOps engineers, security analysts, or infrastructure administrators — via LinkedIn, GitHub, or professional forums.

Step 2 — Social Engineering / Operator Deception: The attacker stands up an attacker-controlled "proxy host" — a server running software that imitates the legitimate Tenable sensor proxy behavior (or simply a tool that expects a specific connection handshake). The attacker then manipulates the operator into connecting a sensor to this rogue host. Techniques include:

• Sending a phishing email with instructions to "reconfigure the sensor proxy" following a purported maintenance window, with a link to attacker-hosted documentation and a specified IP/hostname.
• Compromising a GitHub repository or internal wiki that contains configuration instructions and planting (or altering) the proxy host IP.
• Targeting cloud environments where a sensor is provisioned via infrastructure-as-code — modifying the template or environment variable that defines the proxy endpoint.

Step 3 — Trigger / Weaponization: Once the operator reconfigures the sensor proxy to point at the attacker-controlled host, the sensor initiates the connection. The attacker's host responds to this handshake with crafted data that is interpreted by the sensor proxy as executable code (CWE-94). Since this is a code injection flaw, the attacker can embed a payload — for example, a script or a serialized object containing shell commands — that the proxy executes.

Step 4 — Payload / Execution: The attacker's payload executes with the privileges of the sensor proxy process. Given the "elevated privileges" description, the proxy likely runs as a service account with high-level rights on the host OS (e.g., root on Linux or SYSTEM on Windows). The attacker can:

• Execute arbitrary OS commands to establish a persistent backdoor (e.g., creating an account, installing a beacon).
• Extract the proxy's credentials, configuration files, API tokens, or TLS private keys used to communicate with Tenable cloud/on-prem platform — enabling the attacker to impersonate the legitimate proxy.
• PoC/exploit code is public, lowering the barrier to entry for intermediate attackers to weaponize this flaw.

Step 5 — Post-Exploitation Impact: With control of the sensor proxy, the attacker gains a pivot point into the organization's scanning infrastructure. The compromised proxy can intercept, alter, or drop scan results; it can inject false vulnerability data (potentially causing the organization to ignore real threats or act on false positives); and it can collect credentials and destination data for every sensor connecting through it. From the proxy host, the attacker may move laterally to the broader network if the host is segmented with other scanning/management systems.

Impact Assessment

The critical CVSS score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) underscores the severity:

• Confidentiality (High): The compromised proxy handles scan results, credentials for connected targets, and configuration data. Full exposure of these data is likely.
• Integrity (High): The attacker can modify scan results, alter proxy configuration, or impersonate the proxy, leading to incorrect security posture reporting.
• Availability (High): The attacker could disable the proxy, bringing down an entire fleet of sensors and halting vulnerability scanning operations across the enterprise.
• Scope (Changed): The compromise extends from the proxy into the sensor network and, via credentials harvested, into any systems being scanned — the blast radius is not contained to the single proxy host.

The affected population is any enterprise, government, or MSSP that utilizes Tenable sensors (Nessus, Tenable.io, Tenable.sc) behind a Sensor Proxy. The "operator interaction" requirement (UI:R) means the flaw is not pure drive-by exploitation, but it is a low hurdle given that attackers routinely craft highly convincing social engineering. The attack's public PoC status indicates that proof-of-concept code exists, increasing the near-term threat of active exploitation.

Detection Guidance

Detection should focus on connection patterns to untrusted hosts from sensor proxy processes, and on code execution behavior following such connections.

Sigma Rule

title: Tenable Sensor Proxy - Connection to Potential Rogue Host Leading to Code Execution
id: 16f9ad9e-9c4a-4f2a-b3c1-9e1f991b1c0d
status: experimental
description: Detects attempts by the Tenable Sensor Proxy process to connect to hosts not in a known allowlist, or suspicious child process creation following such a connection.
author: Valtersit Threat Intel Team
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\SensorProxy.exe'
            - '\sensor_proxy_service'
    selection_connection_odd:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\bash.exe'
    condition: selection_parent and selection_connection_odd
falsepositives:
    - Legitimate administrative tasks running from the proxy service directory
level: high

YARA Rule

rule Tenable_Sensor_Proxy_Exploit_Strings
{
    meta:
        author = "Valtersit Threat Intel Team"
        description = "Detects malicious strings or serialized payloads potentially sent to Tenable Sensor Proxy for code injection"
        reference = "CVE-2026-18667"
        date = "2026-05-15"
        score = 60
    strings:
        $s1 = "cmd.exe /c " ascii wide
        $s2 = "/bin/sh -c " ascii
        $s3 = "System.Diagnostics.Process" ascii
        $s4 = "__import__('os').system" ascii wide
        $s5 = "java.lang.Runtime.getRuntime" ascii wide
        $s6 = "eval(base64_decode" ascii wide
    condition:
        uint16(0) == 0x4D5A and any of them
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"TENABLE Sensor Proxy Potential Rogue Connection - CVE-2026-18667"; flow:established,to_server; content:"SensorProxy"; nocase; content:"proxy"; nocase; distance:0; content:"hostname"; nocase; content:"ip"; nocase; pcre:"/^(?!.*(tenable\.com|tenable\.security)).*$/i"; sid:202618667; rev:1; metadata:created_at 2026_05_15, updated_at 2026_05_15, cve CVE-2026-18667, severity critical;)

Note: This rule is a placeholder heuristic; it flags handshake/configuration responses lacking references to known Tenable hosts. Actual tuning requires understanding the proxy's configuration protocol.

Elastic Detection

process where event.action == "exec" and (
  process.parent.name in ("SensorProxy.exe", "sensor_proxy_service") and
  process.name in ("cmd.exe", "powershell.exe", "bash", "sh", "python", "perl", "java", "wscript.exe", "cscript.exe")
)

Splunk SPL Query

index=wineventlog OR index=sysmon
| search (Image="*cmd.exe*" OR Image="*powershell.exe*" OR Image="*bash*" OR Image="*sh*")
| search ParentImage="*SensorProxy*" OR ParentImage="*sensor_proxy_service*"
| table _time, Computer, User, ParentImage, Image, CommandLine
| sort -_time
| stats count by Computer, ParentImage, Image
| where count > 0

Wazuh OSSEC Rule

<group name="tenable_sensor_proxy,">
  <rule id="192210" level="12">
    <if_sid>571</if_sid>
    <field name="win.eventdata.parentImage">SensorProxy</field>
    <field name="win.eventdata.image">cmd.exe|powershell.exe|bash|sh|python|perl</field>
    <description>Potential code execution from Tenable Sensor Proxy - suspicious child process</description>
    <group>attck.execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations (if patch cannot be applied immediately):

   • Restrict egress: Ensure the Sensor Proxy host has strict firewall egress rules allowing communication only to the legitimate Tenable platform endpoints (e.g., *.tenable.com for Tenable.io customers). Block any outbound connections to unknown destinations/destination ports.
   • Enforce a strict hosts file or a network DNS sinkhole to prevent the proxy from resolving internal hostnames to attacker-controlled IPs.
   • Ensure that operator accounts with the rights to configure sensor proxies are protected with MFA and that configuration changes require a secondary approval workflow.
   • Monitor logs for any configuration change where the proxy host is re-pointed to an unfamiliar IP or hostname.
   • Segment the Sensor Proxy host in an isolated network zone with no lateral path to core scanning infrastructure or enterprise resources.

2. Patch / Upgrade Steps:

   • Tenable has released Sensor Proxy version 1.4.2 to address this vulnerability.
   • Download the installation files from the Tenable Downloads Portal: https://www.tenable.com/downloads/sensor-proxy.
   • Validate the checksum/signature of the downloaded installer against Tenable's published hashes.
   • Before upgrade, back up the sensor proxy configuration (sensor_proxy.conf and associated TLS certificates).
   • Apply the update in a staging environment first to confirm compatibility with your current sensor versions (Nessus, Tenable.io agents).
   • Revalidate that all sensors reconnect successfully post-upgrade and that scan results flow normally.
   • After patching, rotate any credentials or API tokens stored within the proxy, assuming potential exposure.

3. Long-Term Hardening:

   • Implement a least-privilege service account for the Sensor Proxy process — do not run it as root or SYSTEM if the environment allows for a reduced privilege account.
   • Integrate the proxy configuration files into a version-controlled configuration management system (e.g., Ansible, Puppet) with change auditing.
   • Conduct periodic social-engineering resilience training for all staff with access to security infrastructure, emphasizing the risk of wiring security tools to untrusted endpoints.
   • Enable comprehensive logging and forwards those logs to the enterprise SIEM for continuous monitoring.
   • Subscribe to Tenable's security notification feed to receive timely updates about future flaws.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18667 — NVD description, CVSS vector, and status.
2. Vendor Advisory (Tenable): https://www.tenable.com/downloads/sensor-proxy — Download page for Sensor Proxy 1.4.2 (fixed version). The CNA title "Sensor Proxy Version 1.4.2 Fixes One Vulnerability" provides the patch reference.
3. CWE Reference: https://cwe.mitre.org/data/definitions/94.html — CWE-94 (Improper Control of Generation of Code).
4. Exploit-DB / PoC Research (Hypothetical): Search for "CVE-2026-18667" in public exploit repositories (e.g., Exploit-DB, GitHub) — PoC status is listed as Public per the threat intel data, and security teams should proactively scan these sources.
5. CISA KEV: Not listed — no known exploitation in the wild has been reported to CISA at the time of writing. However, with a public PoC and a CVSS of 9.6, the risk of near-term weaponization remains substantial, particularly for organizations in critical infrastructure sectors targeted by threat actors leveraging supply-chain attacks against security tooling.