CVE-2026-18667 - Vulnerability Details - OpenCVE

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Tenable	Sensor Proxy

No data.

No data.

References

Link	Providers
https://www.tenable.com/security/tns-2026-21

History

Wed, 05 Aug 2026 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Tenable Tenable sensor Proxy
Vendors & Products		Tenable Tenable sensor Proxy

Tue, 04 Aug 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 03 Aug 2026 22:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.
Title		Sensor Proxy Version 1.4.2 Fixes One Vulnerability
Weaknesses		CWE-94
References		https://www.tenable.com/security/tns-2026-21
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: tenable

Published: 2026-08-03T22:27:29.074Z

Updated: 2026-08-05T03:56:44.048Z

Reserved: 2026-08-03T14:42:52.457Z

Link: CVE-2026-18667

Vulnrichment

Updated: 2026-08-04T19:25:47.716Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18667", "assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "state": "PUBLISHED", "assignerShortName": "tenable", "dateReserved": "2026-08-03T14:42:52.457Z", "datePublished": "2026-08-03T22:27:29.074Z", "dateUpdated": "2026-08-05T03:56:44.048Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "shortName": "tenable", "dateUpdated": "2026-08-03T22:27:29.074Z"}, "title": "Sensor Proxy Version 1.4.2 Fixes One Vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "CWE-94", "type": "CWE"}]}], "affected": [{"vendor": "Tenable, Inc.", "product": "Sensor Proxy", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.2", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host."}]}], "references": [{"url": "https://www.tenable.com/security/tns-2026-21"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Tenable has released Sensor Proxy 1.4.2 to address these issues. The installation files can only be obtained via the Tenable Downloads Portal ( https://www.tenable.com/downloads/sensor-proxy ).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Tenable has released Sensor Proxy 1.4.2 to address these issues. The installation files can only be obtained via the Tenable Downloads Portal (<a href=\"https://www.tenable.com/downloads/sensor-proxy\" title=\"Tenable Downloads - Sensor Proxy\">https://www.tenable.com/downloads/sensor-proxy</a>)."}]}], "credits": [{"lang": "en", "value": "Neil Graves / LVL 0x00, LLC", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-18667"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T03:56:44.048Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18667", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-04T19:25:38.686544Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T19:25:47.716Z"}}], "cna": {"title": "Sensor Proxy Version 1.4.2 Fixes One Vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Neil Graves / LVL 0x00, LLC"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Tenable, Inc.", "product": "Sensor Proxy", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.2", "versionType": "semver"}], "platforms": ["Linux"], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "Tenable has released Sensor Proxy 1.4.2 to address these issues. The installation files can only be obtained via the Tenable Downloads Portal ( https://www.tenable.com/downloads/sensor-proxy ).", "supportingMedia": [{"type": "text/html", "value": "Tenable has released Sensor Proxy 1.4.2 to address these issues. The installation files can only be obtained via the Tenable Downloads Portal (<a href=\"https://www.tenable.com/downloads/sensor-proxy\" title=\"Tenable Downloads - Sensor Proxy\">https://www.tenable.com/downloads/sensor-proxy</a>).", "base64": false}]}], "references": [{"url": "https://www.tenable.com/security/tns-2026-21"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.", "supportingMedia": [{"type": "text/html", "value": "A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94"}]}], "providerMetadata": {"orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "shortName": "tenable", "dateUpdated": "2026-08-03T22:27:29.074Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18667", "state": "PUBLISHED", "dateUpdated": "2026-08-05T03:56:44.048Z", "dateReserved": "2026-08-03T14:42:52.457Z", "assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "datePublished": "2026-08-03T22:27:29.074Z", "assignerShortName": "tenable"}, "dataVersion": "5.2"}