CVE-2014-2848: A race condition in the wmi_malware_scan.nbin plugin before 201402262215 for Nessus 5.2.1 allows local user...

Security readout for executives and security teams

This flaw let a local user on a Windows system being scanned abuse a Nessus malware scanning component to gain higher privileges. The issue is tied to a temporary dissolvable agent executable used by the Nessus WMI malware scan plugin. Business urgency is highest where old Nessus 5.2.1-era plugins are still used for authenticated Windows scanning. Likely exposure is limited to legacy Nessus deployments using wmi_malware_scan.nbin before 201402262215, especially authenticated scans of Windows hosts. Organizations using current Nessus plugins are less likely exposed, but the source bundle does not provide a complete affected-version matrix. Treat this as a legacy-tooling hygiene issue with privilege-escalation impact. Prioritize verification if the organization still runs old Nessus 5.2.1-era scanners or archived offline plugin feeds. Current, continuously updated scanner fleets should be lower concern, pending confirmation. Mitigation focus: Confirm Nessus plugins are newer than wmi_malware_scan.nbin 201402262215.; Update Nessus and its plugin feed using vendor-supported channels.; Review Tenable or vendor guidance for any legacy Nessus 5.2.1 deployments..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.