CVE-2021-20118 Privilege escalation in Nessus Agent

What is CVE-2021-20118?

CVE-2021-20118 is a medium-severity vulnerability in Nessus Agent, published on 9 Sep 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. This is different than CVE-2021-20117.

Which versions are affected by CVE-2021-20118?

It affects 1 product.

Products include Tenable Nessus Agent.

How do I fix CVE-2021-20118?

No fix has been published for CVE-2021-20118 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-20118 being exploited?

There is no known exploitation of CVE-2021-20118 in the wild and no public exploit code.

Other vulnerabilities in Nessus Agent

• CVE-2026-15265 Tenable Agent Path Traversal Leading to Remote Code Execution Critical 9.3
• CVE-2025-36633 Local Privilege Escalation High 8.8
• CVE-2025-36631 Local Privilege Escalation High 8.4
• CVE-2025-36632 Local Privilege Escalation High 7.8
• CVE-2021-20117 Privilege escalation in Nessus Agent Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qq9w-j88c-j3ff.