CVE-2026-57587: Nessus SQL Injection via Reverse DNS – CVSS 5.3 Medium

Technical summary

CVE-2026-57587 is a SQL injection vulnerability (CWE-89) in Tenable Nessus that arises from insufficient input validation on reverse DNS lookups during scan operations. An unauthenticated, remote attacker who controls reverse DNS records for a scanned asset can craft malicious SQL payloads within those DNS responses. When Nessus processes and stores scan results, the unsanitized DNS data is incorporated into database queries, allowing the attacker to execute arbitrary SQL. The vulnerability does not require authentication to the Nessus instance itself, only the ability to influence DNS responses seen by the scanner. The attack vector is network-based with low attack complexity and no user interaction required.

Business impact

Successful exploitation could result in unauthorized disclosure of scan result data, including vulnerability details, asset inventories, and other reconnaissance intelligence gathered by Nessus. Organizations relying on Nessus for compliance reporting, risk assessment, or penetration testing could have their assessment findings leaked or manipulated. This undermines the confidentiality of security assessments and could expose competitive or operational security information. The attack does not enable data modification or denial of service in the scan results, reducing but not eliminating business risk.

Affected systems

Tenable Nessus instances are affected. The specific version range and all affected versions should be confirmed against Tenable's official security advisory, as the ground-truth data does not enumerate specific version numbers. Organizations running Nessus scanners that process assets in networks where attackers can control or intercept DNS are at heightened risk, particularly those scanning untrusted or adversary-controlled network segments.

Exploitability

The attack requires no prior authentication and can be launched remotely, making the initial attack vector simple. However, exploitation depends on a precondition: the attacker must control reverse DNS records for at least one host that Nessus scans. This is not a trivial requirement in most corporate environments but is achievable if the attacker controls an authoritative nameserver, compromises DNS infrastructure, or operates within a network where DNS spoofing is possible. The low attack complexity (AC:L) means once DNS control is established, the SQL injection itself is straightforward to execute. The CVSS 3.1 score of 5.3 (MEDIUM) reflects confidentiality impact limited to scan result data with no integrity or availability impact on the Nessus system itself.

Remediation

Apply security patches from Tenable Nessus as soon as they become available. Verify the specific patched version numbers against Tenable's official security advisory. In the interim, implement DNS security controls: use DNSSEC to validate DNS responses, restrict DNS queries to trusted resolvers, and monitor reverse DNS lookups for anomalous payloads. Segment scanner networks to minimize the attack surface and limit scanning of untrusted assets. Consider deploying network-based detection to identify SQL injection attempts in DNS-to-Nessus data flows.

Patch guidance

Contact Tenable or consult their security advisories for the specific patched versions addressing CVE-2026-57587. Prioritize patching according to your organization's vulnerability management SLA for MEDIUM-severity remote unauthenticated issues. Test patches in a non-production environment first, as Nessus configuration and scan schedules should be preserved. Plan for coordinated patching across all Nessus installations in your environment to avoid uneven exposure.

Detection guidance

Monitor Nessus logs and database activity for SQL syntax errors or unexpected query patterns coinciding with scan operations. Network detection should focus on reverse DNS responses containing unusual character sequences or SQL keywords. If your organization uses DNS security tools, enable alerting for DNS responses with high entropy or embedded SQL payloads. Correlate Nessus scan timing with suspicious database queries targeting the scan results table. Endpoint Detection and Response (EDR) tools should monitor Nessus process behavior for unexpected database connections.

Why prioritize this

Although scored MEDIUM, this vulnerability merits prioritization because it affects a widely deployed security assessment tool and requires no authentication. Compromise of scan results could expose your entire security posture to an attacker. The precondition of DNS control is not negligible, which justifies the MEDIUM rating over HIGH, but organizations should not delay patching. Prioritize patching if your Nessus instance scans assets in networks where DNS spoofing or attacker-controlled infrastructure is a realistic threat model.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible, unauthenticated vulnerability with low attack complexity, but impact is limited to confidentiality of scan result data (C:L) with no impact to integrity or availability (I:N, A:N). The score does not account for the prerequisite of DNS control, which the attacker must establish separately. In your organization, the effective risk is higher if DNS security controls are weak, and lower if DNSSEC and DNS monitoring are mature. Adjust remediation timing based on your DNS security posture and the sensitivity of assets being scanned.

Frequently asked questions