A weakness in the file permissions of the Nessus Agent directory on Windows hosts allows an attacker to gain unauthorized access to the directory. The adversary can then interrupt the operation of the agent, effectively causing a denial of service. The vulnerability is a result of improper access control (CWE-276) which limits the confidentiality, integrity, and availability of the agent when compromised.

Tenable Nessus Agent installed on Windows systems is affected. The vulnerability applies to all versions released before the publication of Nessus Agent 11.0.4 and 11.1.2. The attack surface is confined to the product’s installation directory, where permission misconfiguration occurs.

The CVSS score of 5.4 indicates a moderate severity. The EPSS probability of less than 1% suggests a low likelihood of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that the attack vector requires local access or the ability to write to the agent directory, after which a denial of service can be induced by manipulating file permissions or corrupting configuration files.