CVE-2018-1147: In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation.

Security readout for executives and security teams

Nessus versions before 7.1.0 can mishandle input in ways that allow cross-site scripting. An authenticated remote user could upload crafted Nessus content that, when viewed by an administrator, runs script in that administrator's browser session. This primarily matters for organizations still running older Nessus deployments. Exposure is likely limited to Nessus instances older than 7.1.0 where authenticated users can upload .nessus files or alter relevant Advanced Settings. Internet exposure is less important than account access and administrator interaction. Prioritize remediation for any still-running legacy Nessus instance. The vulnerability requires authentication, but successful use could affect administrator sessions in a security-management platform, increasing operational sensitivity. Mitigation focus: Upgrade Tenable Nessus to version 7.1.0 or later per Tenable guidance.; Review Tenable advisory TNS-2018-05 for any environment-specific instructions.; Restrict Nessus access to trusted users until upgraded..

Prepared

Jun 7, 2026, 13:21 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.