CVE-2016-1000028: Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI,...

Security readout for executives and security teams

This is a stored cross-site scripting issue in Tenable Nessus before 6.8. The public description says exploitation requires admin-level access to the Nessus web UI and would only potentially affect other administrators, so business urgency is limited unless outdated Nessus admin consoles remain in use. Exposure is mainly organizations still running Nessus versions before 6.8 with multiple administrators using the same UI. Risk is lower where Nessus is current, admin access is tightly controlled, and the UI is not broadly reachable. Treat as low priority compared with remotely exploitable vulnerabilities, but remediate during normal vulnerability management if legacy Nessus remains deployed. The main concern is trust boundary weakness between administrators on an outdated security platform. Mitigation focus: Upgrade Nessus to 6.8 or later, following Tenable guidance.; Restrict Nessus UI access to trusted administrative networks.; Review and minimize Nessus administrator accounts..

Prepared

Jun 6, 2026, 03:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.