CVE-2026-57588

LOW

SQL Injection in Nessus via Malicious Scan Result File Import

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-57588. PoCs published by banyamer, CerberusMrXi.

AI-analyzed exploit summary This exploit generates a malicious .nessus XML file containing SQL injection payloads in host property tags. When imported by a privileged Nessus user, it exploits insufficient input sanitization in the scan result import functionality to exfiltrate database information or read files via PostgreSQL functions.

Description

A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.

Exploits (2)

exploitdb WORKING POC
by banyamer · pythonwebappsmultiple
https://www.exploit-db.com/exploits/52620

This exploit generates a malicious .nessus XML file containing SQL injection payloads in host property tags. When imported by a privileged Nessus user, it exploits insufficient input sanitization in the scan result import functionality to exfiltrate database information or read files via PostgreSQL functions.

Classification
Working Poc 98%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Tenable Nessus 10.12.0 and prior
Auth required
Prerequisites: Social engineering to trick a privileged Nessus user into importing the malicious .nessus file · PostgreSQL backend (default in Nessus)
mistral-large-3 · analyzed Jul 08, 2026 Full analysis →
nomisec WORKING POC
by CerberusMrXi · poc
https://github.com/CerberusMrXi/CVE-2026-57588-Nessus-XML-Import-SQL-Injection-PoC

This repository contains a functional exploit for CVE-2026-57588, a SQL injection vulnerability in Tenable Nessus 10.12.0 and prior. The exploit targets the XML import functionality, allowing authenticated users with import privileges to execute arbitrary SQL queries, including data exfiltration, command execution, and file system access via PostgreSQL functions.

Classification
Working Poc 98%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Tenable Nessus 10.12.0 and prior
Auth required
Prerequisites: Authenticated access to Nessus with import privileges · Ability to craft malicious .nessus XML files · Network access to the Nessus instance
mistral-large-3 · analyzed Jul 22, 2026 Full analysis →

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory
TNS-2026-17
https://www.tenable.com/security/tns-2026-17

Scores

CVSS v3 3.3
EPSS 0.0034
EPSS Percentile 26.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (2)
tenable/nessus < 10.12.1
tenable/Nessus prior to 10.12.1
Published Jun 25, 2026
Tracked Since Jun 25, 2026