This vulnerability permits an attacker to create a junction that can delete arbitrary files with SYSTEM privileges, thereby potentially enabling the execution of malicious code with elevated permissions. The flaw is a file system manipulation weakness that, if exploited, could compromise the integrity of the target system and lead to full system compromise.

The affected products are Tenable Nessus and Tenable Nessus Agent. No specific version information is provided, so all installations of these products are considered potentially impacted until the vendor issues a fix.

The CVSS score of 7.4 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the current time. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local exploitation by a user with enough privileges to run Nessus or its agent; an attacker would need to achieve or already possess SYSTEM-level rights to take advantage of the junction creation and file deletion capability. The potential for arbitrary code execution depends on additional conditions beyond the junction manipulation, but the capability is present if the attacker can orchestrate the deletion of system files and replace them with malicious binaries.