Tenable Nessus 10.12.1 Fixes SQL Injection Vulnerabilities (CVE-2026-57587/57588)

[R2] Nessus Version 10.12.1 Fixes SQL Injection Vulnerabilities Vulnerability Overview Vulnerabilities exist in Nessus versions 10.12.0 and earlier. Attackers can perform SQL injection via reverse DNS records and scan result files, which are injected by privileged Nessus users. These attack vectors may lead to unintended leakage of scan result data. Impact Scope Affected Products: Nessus 10.12.0 and earlier Remediation Fixed Version: Nessus 10.12.1 Release Date: 2026-06-25 Risk Information CVE ID: CVE-2026-57587, CVE-2026-57588 Tenable Advisory ID: TNS-2026-17 Risk Factor: Medium CVSSv3 Base/Ecosystem Score: 5.3 / 4.9 (CVE-2026-57587), 3.3 / 3.1 (CVE-2026-57588) CVSSv3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C (CVE-2026-57587), AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C (CVE-2026-57588) CVSSv4 Base Score: 2.1 (CVE-2026-57587), 1.6 (CVE-2026-57588) CVSSv4 Vector: AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VIN:VAN/SC:N/SIN:SAN/E:P (CVE-2026-57587), AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VIN:VAN/SC:N/SIN:SAN/E:P (CVE-2026-57588) CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Disclosure Timeline 2026-06-15: Report received by Tenable 2026-06-09: Report received by Tenable 2026-06-24: CVE ID Request / CVSS Score Calculation 2026-06-25: Nessus 10.12.1 Released Suggested Timeline 2026-06-25: [R1] Initial Release 2026-06-25: [R2] Summary Update

Goal Reached Thanks to every supporter — we hit 100%!

Tenable Nessus 10.12.1 Fixes SQL Injection Vulnerabilities (CVE-2026-57587/57588)