Fudo Security API v2 Compatibility
Summary Tenable is proud to announce compatibility with Fudo API v2. Customers now have the option to use both the API v2 and API v1 of the Fudo Security Privileged Access Management (PAM) solution. The API v2 uses API key authentication and not username and password, so customers using the integration credential now have a field for API URL and API Key. Further information regarding these changes and other helpful configuration tips for scans can be found by following the provided link to the FUDO section of Tenable's documentation page. Impact Existing scan configurations remain unaffected. Customers utilizing the integration will observe that the integration collects identical information, irrespective of the API version employed. Target Release Date 09/16/2025 for TVM and Nessus, TBD for SC
Improved Printer Fingerprinting
Summary This document addresses an issue where network printers generate unnecessary prints when scanned, even with the "Don't Scan Printers" setting enabled. The fix involves improving the SNMP identification process for printers by falling back to default community strings and ports if an incorrect community string is initially configured. Background Currently, if a customer configures an incorrect SNMP v1/v2(c) community string for a device, Plugin ID 11933 / "Do not scan printers" fails to revert to using well-known, default SNMP v1/v2(c) community strings and ports, unlike other plugins. This failure can prevent accurate identification of network printers, leading to them being scanned and in some cases, may inadvertently queue print jobs on printers Impact The following assumes the user has enabled the "Do not scan printers" setting in their scan policy and the network printer is correctly identified as such: Potential Decrease in Reported Vulnerabilities: Network printers will be less heavily scanned, potentially leading to a decrease in reported vulnerabilities related to these devices. Slight Increase in Packet Traffic: There will be an increase of approximately three packets per host as the system attempts fallback SNMP connections. Printers Marked as "Dead": Network printers that are successfully identified via SNMP will be marked as "dead" and will not be scanned further. This change aims to enhance the effectiveness of identifying network printers using SNMP, thereby reducing unnecessary and potentially damaging traffic directed at these devices. The resulting decrease in reported vulnerabilities is an expected outcome, as identified printers will no longer be subjected to heavy scanning. Users can continue to scan network printers by enabling the "Scan Network Printers" setting under “Host Discovery -> Fragile Devices -> Scan Network Printers” in the scan policy. This ensures that printers are scanned and not marked as dead, irrespective of fingerprinting. Affected Plugins 11933 ( "Do not scan printers") Affected Scan Policy Settings Discovery -> Host Discovery -> Fragile Devices -> Scan Network Printers Tenable Security Center Tenable Vulnerability Management Tenable Nessus Target Release Date: Monday, September 15, 2025
Include/Exclude Path and Tenable Utils Unzip added to Log4j Detection
Summary Tenable has updated the Apache Log4j detection plugins. The Windows plugin will now honor the Include/Exclude Filepath configuration option. The Linux/UNIX plugin will now use the version of ‘unzip’ supplied with the Nessus Agent, when enabled in the Agent’s configuration, and correctly inspect the MANIFEST.MF and pom.properties files. Change Before this update, plugin 156000, Apache Log4j Installed (Linux / Unix), would fail to detect Log4j in specific scan scenarios. The plugin uses several inspection methods to determine if a JAR file is a copy of Log4j. During Nessus Agent scans, as well as scans with ‘localhost’ as a target, the plugin was not properly executing the unzip command to inspect META-INF/MANIFEST.MF and pom.properties files in the JAR archive. If this method was the only option that would result in a successful detection, the copy of Log4j would not be detected properly. In addition, the plugin had failed to launch the unzip binary supplied with the Agent when inspecting files in JAR archives. Note: The Nessus Agent can be configured to use find and unzip binaries that it provides, instead of those supplied by the asset’s operating system. See https://docs.tenable.com/vulnerability-management/Content/Scans/AdvancedSettings.htm#Agent_Performance_Options for more information. Also before this update, plugin 156001, Apache Log4j JAR Detection (Windows), would fail to honor the directories included or excluded for full-disk searches configured in the Windows Include Filepath and Windows Exclude Filepath directives in the Advanced Settings of a scan config. Note: Configuration of these options is described in https://docs.tenable.com/vulnerability-management/Content/Scans/AdvancedSettings.htm#Windows_filesearchOptions. After this update, plugin 156000 will use the Agent-supplied copy of unzip when configured to do so. If this option is not enabled in the scan config, the plugin will use the existing method to find and execute an archive utility supplied by the asset’s operating system. In either case, the plugin will properly inspect Log4j’s MANIFEST.MF and pom.properties files as a version source. Plugin 156001 already properly inspects these files. Also after this update, plugin 156001’s Powershell code will now honor directories included or excluded by the Filepath directives. Plugin 156000 already supported this feature. Impact When scanning Linux / UNIX assets via 'localhost' (i.e. scanning the scanner itself) or with the Nessus Agent, additional Log4j instances from MANIFEST.MF or pom.properties sources may be reported. For Linux Nessus Agents with "Use Tenable supplied binaries for find and unzip" enabled and "Agent CPU Resource Control - Scan Performance Mode" set to Low, plugin 156000 will now properly limit CPU usage during scans. As noted in the product documentation, “Note: Setting your process_priority preference value to low could cause longer running scans. You may need to increase your scan-window timeframe to account for this value.” Customers should be aware of this configuration setting and potential changes to the results provided in the Log4J detection results. When scanning Windows targets, Log4j JAR files stored in paths specified in the Windows Exclude Filepath configuration will no longer be detected. Log4j JAR files stored in paths or drives specified in the Windows Include Filepath configuration that had not been previously scanned will now be detected, assuming they can be assessed before the plugin’s configured timeout has been reached. Plugins 156000 - Apache Log4j Installed (Linux / Unix) 156001 - Apache Log4j JAR Detection (Windows) Target Release Date September 1, 2025Excluding the SUSE Linux Snapshots directory from Language Library enumeration
Summary The “language library” enumeration plugins will now exclude SUSE Linux’s snapshots directory when searching the filesystem. Change Before the update, when enumerating “language libraries” - such as Python packages, Node.js modules, etc. - on SUSE Linux hosts that use btrfs as their filesystem, reduced scan performance was observed. This is because btrfs creates and maintains snapshots in the /.snapshots directory, which can contain multiple redundant copies of files. This caused unnecessary processing on thorough scans. After the update, this snapshots directory has been excluded from searches executed by the find command for language library enumeration plugins on SUSE Linux. Impact This change is expected to improve the performance of scans on SUSE Linux assets. If language libraries were present in snapshots directory, they will no longer show up in Tenable scan results, along with any associated vulnerabilities. If customers would like to scan the snapshots directory, the "Include Filepath" option in the Advanced Scan Settings configuration can be used to force the scanning of these paths. Plugins 178772 - Node.js Modules Installed (Linux / Unix) 190687 - NuGet Installed Packages (Linux / Unix) 164122 - Python Installed Packages (Linux / Unix) 207584 - Ruby Gem Modules Installed (Linux / Unix) Target Release Date September 3, 2025Vulnerability Scanning Container Directory Exclusion Summary
Vulnerability Scanning Container Directory Exclusion Summary Directories that store container image layers will be excluded by default from vulnerability scanning for Tenable Vulnerability Management, Security Center and Nessus. The directories that will be excluded are those configured for container storage by the container management solution. Docker: The "Docker Root Dir:" as returned by the "docker info" command. This is /var/lib/docker by default. Podman: The "graphRoot:" as returned by the "podman system info" command. This defaults to /var/lib/containers/storage. containerd: The "root =" directory as returned by the "containerd config dump" and "containerd config default commands. This location is /var/lib/containers/storage by default. CRI-O: The "storage graph root:" as returned by running "crio status info". This location is /var/lib/containers/storage by default. What is the impact? Vulnerabilities previously detected as a result of scanning these directories will become mitigated on the next scan and findings not returned in future scans. These findings are a result of examining the container image layers on the filesystem. The container may not necessarily be running and represent risk to your organization and customers generally consider these results as false positives since they are managed Docker deployments. Tenable Cloud Security is designed to secure container images and provide pre-deployment validation. Recursively scanning these directories is a resource and time consuming process. The exclusion of the directories may also result in decreased scan times. Can I override the change? You could add an Include Filepath rule to your scan configuration in order to override the default exclusion behavior. This may be found under the Scan Policy Advanced Options. A note of caution that overriding the default behavior could affect scan performance or give results that are unable to be remediated since within a managed container. In order to include a directory that is automatically excluded, the user include filepath has to match the excluded directly exactly. Example: If your Docker configuration uses /var/lib/docker for container storage you would add /var/lib/docker to your user filepath inclusions. Adding a more or less specific location will have no effect. What are the affected plugins? At the time of this release highlight publication, the following plugins are leveraging find: 142023 - Apache Cassandra Installed (Linux) 133766 - Apache Maven Installed (Linux / Unix) 135172 - Oracle NoSQL Database Installed (Linux) 117706 - MagniComp SysInfo Installed (Linux/UNIX) 111679 - FasterXML Jackson Databind Detection for Linux/UNIX 112063 - Kubernetes Installed (Linux) 136340 - nginx Installed (Linux/UNIX) 131566 - Atlassian Jira Installed (Unix / Linux) 147817 - Java Detection and Identification (Linux / Unix) 132771 - Palo Alto Cortex XSOAR Installed (Unix / Linux) 132872 - Foxit Reader Installed (Linux) 174788 - SQLite Local Detection (Linux) 151883 - Libgcrypt Installed (Linux/UNIX) 99671 - Apache Struts Detection for Linux/UNIX 156000 - Apache Log4j Installed (Linux / Unix) 141394 - Apache HTTP Server Installed (Linux) 71642 - Oracle Installed Software Enumeration (Linux / Unix) 156551 - Oracle MySQL Enterprise Monitor Installed (macOS) 124276 - Oracle Tuxedo Installed (Linux/UNIX) 73913 - Oracle WebLogic Server Detection 133962 - Sophos Anti-Virus Installed (Linux) 186361 - VMWare Tools or Open VM Tools Installed (Linux) 187057 - OwnCloud OwnCloud Installed (Linux) 70349 - Adobe Acrobat Installed (Mac OS X) 72202 - JBoss Detection 147022 - SAP Adaptive Server Enterprise (ASE) Installed (Linux) 163488 - Terraform Configuration Detection for Linux/UNIX 77028 - IBM Installation Manager Detection (Linux / Unix) 145032 - IBM WebSphere eXtreme Scale (Linux) 144633 - IBM MQ Server and Client Installed (Linux) 136341 - Dell EMC Data Protection Central Installed (Linux) 133964 - SELinux Status Check 159273 - Dockerfile Detection for Linux/UNIX 174164 - Google Protobuf Go Module Installed (Linux/UNIX) 158567 - Citrix Workspace App Installed (nix) 55420 - Adobe Reader Installed (Mac OS X) Target Release Date April 30, 2025Tenable InTune MDM Integration: Application Authentication...
Tenable InTune MDM Integration: Application Authentication Summary In order to modernize our authentication standards, Tenable is announcing a new authentication option for the InTune Mobile Device Management (MDM) integration, called “application” authentication. Details When configuring an InTune Mobile credential, it is now possible to select between “user” and “application” authentication types. With user authentication, a user account is required as well as application credentials. With application authentication, the scanner requests API data on behalf of the application and not a user, therefore application credentials are required but user credentials are not. Please note that the application authentication type requires a specific permissions configuration, specifically permissions must be of type “Application” rather than “Delegated”. Updates have been made to the Tenable and Microsoft Intune Mobile Device Management Integration Guide to provide steps to configure authentication. For more information on the differences between user and application access scenarios, please refer to the Microsoft documentation: https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview#access-scenarios Impact Customers are not required to update configurations at this time; existing scans will continue to use user authentication. We encourage customers to review the updated documentation. Customers who plan to enforce mandatory multi-factor authentication (MFA) for user accounts may wish to change to application authentication. Release Date 7 April 2025 for Nessus and TVM, TBD for SecurityCenterRed Hat: Custom RPM Repository Handling Improvements...
Red Hat: Custom RPM Repository Handling Improvements Summary Users with custom Red Hat repository naming conventions in their enterprise can now upload a custom mapping file in json format that maps custom RPM repository relative URLs to the official Red Hat counterparts for the purposes of vulnerability scanning. Problem Many Red Hat and Tenable customers utilize custom repository configurations and/or mirrors. In these cases, where neither the configured repository label or URL match Red Hat’s official mapping, Tenable plugins are unable to determine what software updates are available to the scan target. This can result in an increased number of potential false positive findings for Red Hat Local Checks. Solution With this update, we have introduced a method that allows users to upload a json file via their scan policy that maps their internal custom repository relative URL to the official Red Hat label and URL of the repository it mirrors. To upload this json file to your scan policy, go to “Settings > Advanced > Vulnerability Options > Custom Red Hat Repository Mapping” and click on the “Add File” link. For a more detailed overview of how this works in practice, please refer to the following user guide: How Red Hat Local Vulnerability Checks Use Repositories To Determine Scope Impacted Plugins All plugins in the Red Hat Local Security Checks family New plugin added: Plugin ID 233963, redhat_custom_repos.nasl Updated Scan Policy Templates Nessus Scanner Advanced Scan Advanced Dynamic Scan Basic Network Scan Nessus Agents Advanced Agent Scan Basic Agent Scan Targeted Release Date Nessus and Tenable VM: Monday, April 14, 2025 Tenable Security Center: TBCTenable OT New Plugin Family Summary Tenable OT Security...
Tenable OT New Plugin Family Summary Tenable OT Security will provide event-based findings to Tenable One platform with new description only plugins. These new OT plugins will be grouped in a new dedicated plugin family named "Tenable OT Violation". Change A new plugin family named "Tenable OT Violation" will be created. This new family will only be used for new OT plugins dedicated to event-based findings such as “Firmware Version Change Detected” or “Controller Code Upload Detected”. Impact No previous OT plugins will be updated with the new family, only the new OT plugins dedicated to event-based findings. These plugins only give findings if you have configured policies with triggered events. Target Release Date The new OT family and the new OT plugins will be released during the second week of April 2025.
Vendor Unpatched Vulnerability Coverage Summary Tenable is...
Vendor Unpatched Vulnerability Coverage Summary Tenable is making fundamental improvements to reporting findings for vulnerabilities that do not have a patch available from the vendor (Vendor Unpatched Vulnerabilities). Customers can now scan for Red Hat Enterprise Linux, Ubuntu, and Debian Linux vulnerabilities that do not have a patch available. Impact Customers who opt-in to scanning for Vendor Unpatched Vulnerabilities by adding the “Scan for unpatched vulnerabilities (no patched or mitigations available)” setting to their scan policy will be able to scan for this class of vulnerability. Tenable will publish a plugin for each CVE with a vulnerability without a patch in any affected and supported operating systems. At this time, Red Hat Enterprise Linux, Ubuntu, and Debian Linux are supported for this feature. Should one or more of the vendors release a patch for one or more of the affected packages, the relevant check(s) will be removed from the plugin; if no checks remain, the plugin will be deprecated. Since the information provided by the vendor does not include which versions of a given package are affected, the checks simply test for the presence of the affected package at any version. The initial feature release will contain approximately 6,000 plugins. As these plugins are released, they will be reflected in the Plugin Search results page here. Due to the large number of plugins being released during this initial cycle, customers will experience a significant plugin feed differential. Target Release Date March 4, 2025Tenable Research Release Highlight Ping-Only Discovery Scan...
Tenable Research Release Highlight Ping-Only Discovery Scan Summary In response to customer feature requests for a lightweight, minimally intrusive host discovery scan, Tenable is providing a new Ping-Only Discovery scan template. The Ping-Only Discovery scan will provide scalpel-like tailoring of user specified protocols enabling fast discovery scans with minimal network traffic to scan targets. Change Ping-Only Discovery is a scan template similar to Host Discovery but with fewer checks and fewer packets sent on the wire. The Ping-Only Discovery scan will attempt to discover hosts with minimal network traffic. It sends ICMP pings by default and can be configured to attempt a TCP ping on the Discovery tab. A UDP ping can be configured, also, but will cause the scan time and packets sent to increase. The scan will not resolve FQDNs, will not run OS fingerprinting, and will not attempt to avoid Fragile Devices. Impact In an effort to minimize network traffic and discovery time, the scan will not attempt to identify fragile devices (printers, OT devices, etc) and will therefore send pings to any device in the Targets list. The simplest version, just sending an ICMP ping, shouldn’t cause any issues here, but be cautious if you know you are scanning these device types and you configure the ICMP plus TCP ping options for this scan. Discovery scans using this Ping-Only Discovery template will run 2 to 5 seconds faster per host on average. Protocols can be custom tailored to meet specific customer requirements in their environments. Target Release Date This feature will be released in TVM and Nessus on February 25, 2025. The feature release date for Tenable Security Center is TBD.