CVE-2026-2026

Executive Summary

CVE-2026-2026 identifies a vulnerability in the Nessus Agent for Windows where weak file permissions on the installation directory allow a local, authenticated attacker to perform a Denial of Service (DoS) attack. By modifying or deleting critical files within the agent’s directory, an attacker can disrupt the agent’s functionality, preventing it from performing scans or reporting results. This vulnerability does not require network access but does require local access to the Windows host. The CVSS score is 0.0 due to incomplete scoring data, but the actual risk is moderate for environments where untrusted users have local access. No public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Windows application (Nessus Agent) distributed by Tenable. The risk is limited to the local installation and does not extend to open-source package ecosystems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Base Score: 5.5 (Medium)
• Attack Vector: Local (AV:L) – attacker must have local access to the Windows host.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs a standard user account.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – no data exposure.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: High (A:H) – agent can be rendered inoperable.

Threat Level: Medium. Exploitation requires local access, but the impact is limited to denial of service. No remote exploitation is possible.

Deep Dive & Mechanics

The Nessus Agent on Windows is installed with default file permissions that may allow non-privileged users to write to or delete files within the agent’s installation directory (e.g., C:\Program Files\Tenable\Nessus Agent). The vulnerability stems from the use of weak discretionary access control lists (DACLs) that grant BUILTIN\Users or Everyone modify or write permissions.

An attacker with a local user account can:

• Delete critical binaries or configuration files, causing the agent to crash or fail to start.
• Replace legitimate files with malicious ones (though this would require additional privileges for execution, the DoS is still achievable by file deletion).
• Overwrite log files or configuration to disrupt agent behavior.

The agent does not validate file integrity at startup, so any tampering leads to immediate or eventual service failure. This is a classic CWE-276 (Incorrect Default Permissions) issue.

Vulnerable vs. Patched Code

No specific code diff is available because the vulnerability is configuration-based rather than a code flaw. The vulnerable state is the default file permissions on the Nessus Agent directory. A patched state would involve restricting permissions to only SYSTEM and Administrators.

Vulnerable Permissions (example):

icacls "C:\Program Files\Tenable\Nessus Agent"
# Output may show: BUILTIN\Users:(OI)(CI)(RX,W)  # Write access for Users

Patched Permissions (example):

icacls "C:\Program Files\Tenable\Nessus Agent" /inheritance:r
icacls "C:\Program Files\Tenable\Nessus Agent" /grant SYSTEM:(OI)(CI)F
icacls "C:\Program Files\Tenable\Nessus Agent" /grant Administrators:(OI)(CI)F
icacls "C:\Program Files\Tenable\Nessus Agent" /grant BUILTIN\Users:(OI)(CI)RX

Exploitation & Lab Setup

Red Team

Prerequisites: Local access to a Windows host with Nessus Agent installed and a standard user account.

Steps:

1. Identify the Nessus Agent installation directory (default: C:\Program Files\Tenable\Nessus Agent).
2. Verify weak permissions using icacls.
3. Delete a critical file, e.g., nessusd.exe or agent.cfg:

   del "C:\Program Files\Tenable\Nessus Agent\nessusd.exe"
   

4. The agent service will fail to start or crash immediately.
5. Alternatively, create a large file to fill the disk:

   fsutil file createnew "C:\Program Files\Tenable\Nessus Agent\junk.dat" 1073741824
   

Expected Outcome: The Nessus Agent becomes unresponsive, and scans fail. The service may show as stopped in services.msc.

Blue Team

Detection:

• Monitor file deletion events in the Nessus Agent directory (Event ID 4663 with access mask 0x2 for DELETE).
• Monitor service crashes (Event ID 7031, 7034).
• Use Sysmon to log file creation/deletion in C:\Program Files\Tenable\Nessus Agent\*.

Prevention:

• Apply the patched permissions immediately.
• Use AppLocker or Windows Defender Application Control to block unauthorized executables.
• Enable Windows Firewall to restrict outbound traffic from the agent (though not directly related).

Hunting:

• Query for icacls changes on the directory.
• Look for unusual processes accessing the agent directory.

Indicators of Compromise (IOCs)

• File Path: C:\Program Files\Tenable\Nessus Agent\nessusd.exe (deleted or modified)
• File Path: C:\Program Files\Tenable\Nessus Agent\agent.cfg (deleted or modified)
• Event ID 4663: Access to C:\Program Files\Tenable\Nessus Agent\* with DELETE access by a non-admin user.
• Event ID 7031: Nessus Agent service terminated unexpectedly.
• Registry Key: HKLM\SYSTEM\CurrentControlSet\Services\Nessus Agent (modified)
• Network: No specific network IOCs, as this is a local DoS.

Detection Engineering

YARA Rule

rule Detect_Nessus_Agent_Weak_Permissions {
    meta:
        description = "Detects weak file permissions on Nessus Agent directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-2026"
    strings:
        $s1 = "BUILTIN\\Users:(OI)(CI)(RX,W)" nocase
        $s2 = "Everyone:(OI)(CI)F" nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: Nessus Agent Weak File Permissions
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to modify or delete files in the Nessus Agent directory by non-admin users
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-2026
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|startswith: 'C:\Program Files\Tenable\Nessus Agent\'
        AccessMask: '0x2'  # DELETE
    condition: selection
falsepositives:
    - Legitimate uninstall by administrator
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-2026 Nessus Agent DoS Attempt"; flow:to_server; content:"nessusd.exe"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder; the vulnerability is local and may not generate network traffic. Adjust based on actual agent behavior.

Remediation & Mitigation

Immediate Actions:

1. Manually correct file permissions on the Nessus Agent directory:

   takeown /f "C:\Program Files\Tenable\Nessus Agent" /r /d y
   icacls "C:\Program Files\Tenable\Nessus Agent" /inheritance:r
   icacls "C:\Program Files\Tenable\Nessus Agent" /grant SYSTEM:(OI)(CI)F
   icacls "C:\Program Files\Tenable\Nessus Agent" /grant Administrators:(OI)(CI)F
   icacls "C:\Program Files\Tenable\Nessus Agent" /grant BUILTIN\Users:(OI)(CI)RX
   

2. Restart the Nessus Agent service after permissions are applied.

Long-Term Fix:

• Monitor Tenable’s advisory for an official patch that corrects default permissions.
• Implement a Group Policy Object (GPO) to enforce correct permissions on all Nessus Agent installations.
• Use Windows Defender Attack Surface Reduction (ASR) rules to block untrusted processes from accessing the agent directory.

Workaround:

• If patching is not possible, remove the BUILTIN\Users group from the directory’s ACL entirely (may break functionality if the agent runs as a standard user).

Valters IT