Research Release Highlight – "Fully Scan Operational Technology" Default Setting Change
Summary The "Fully Scan Operational Technology" (OT) preference controls whether Nessus actively scans OT/ICS devices during a scan. This setting is intended to be disabled by default to avoid unintended disruption to sensitive operational technology environments. A long-standing setting in the Do not scan operational technology devices plugin caused this preference to default to enabled in a Basic Network Scan when the discovery type is not set to Custom. Change The default value for "Fully Scan Operational Technology" preference has been corrected from yes to no. Impact This fix will affect existing Basic Network scans automatically upon the next feed update — no scan recreation is required. Customers using Basic Network Scan policies with a non-custom discovery scan type will see the following behavioral change: Before change: "Fully Scan Operational Technology" was silently enabled, meaning OT devices may have been actively scanned. After change: "Fully Scan Operational Technology" will correctly default to disabled. Customers who intentionally want to scan OT devices should explicitly enable the "Fully Scan Operational Technology" preference by switching their scan policy's discovery type to Custom, which will expose the preference in the UI and allow it to be toggled on. Affected products: Tenable Security Center (SC), Tenable Vulnerability Management (TVM), and Nessus Target Release Date July 13, 2026
NuGet Package Enumeration Updates
Summary Tenable has updated the NuGet package enumeration plugins to improve detection of installed NuGet packages on Linux/Unix scan targets. Change Before this update, the NuGet package enumeration plugins did not attempt to associate detected packages with an RPM or DEB package managed by the Linux distribution. This could cause packages to report vulnerabilities both based on a Linux distribution vendor's advisory and a CVE advisory from the NuGet package maintainer. After this update, these issues have been addressed. NuGet packages on Linux assets will be assessed to determine if they are managed by a Linux distribution's package manager, and if so, will be marked as “Managed” and will not report a vulnerability, unless the Show potential false alarms setting is enabled for the scan. Impact Most customers will notice improved accuracy in NuGet package vulnerability reporting. Scan results may show changes in detected vulnerabilities based on how packages were previously assessed. Affected plugins 190687 - NuGet Installed Packages (Linux / Unix) Target Release Date June 1, 2026Plugin output for language library enumeration
Summary The plugins that enumerate Node.js, Python, and Ruby packages will now list the discovered packages in their output. Change Before this update, Tenable had updated some of the “language library” enumeration plugins - specifically for Node.js, Python, and Ruby - so that they would no longer list the discovered packages in the plugin output. This was a performance-related decision. When scanning assets with a substantial number of discovered packages, Tenable found that in many cases the size of the findings set would be so large that it would exhaust the memory allocated to the plugin and cause the plugin to crash without reporting. This would prevent downstream vulnerability plugins from detecting vulnerable packages and result in false negatives. Tenable found this to be a less desirable outcome, and began investigating solutions to make these findings sets available at the platform level. Customer feedback has led us to revert this change and develop an alternative solution for reporting from these plugins. After this update, the plugins below will now list the discovered packages, along with their path and version, in the plugin output, which can be used to locate specific installed packages on assets. Tenable will continue to investigate a platform-level feature to allow customers to locate specific language libraries across all managed assets in Tenable One. Impact Plugin output for updated plugins will include a list of detected packages. This may substantially increase the size of scan results in accordance with the number of detected packages. Plugins 200172 - Node.js Modules Installed (Windows) 179440 - Node.js Modules Installed (Linux) 178772 - Node.js Modules Installed (macOS) 181215 - Python Installed Packages (Windows) 164122 - Python Installed Packages (Linux/macOS) 240646 - Ruby Gem Modules Installed (macOS) 207585 - Ruby Gem Modules Installed (Windows) 207584 - Ruby Gem Modules Installed (Linux) Target Release Date April 27, 2026
Stop Guessing, Start Securing: New Secrets Validation for WAS
Finding a leaked credential in your web application is a bad day. Finding out that credential is live and grants access to your GitHub or cloud environment? That’s a crisis. To help you distinguish between a harmless string of text and a major security hole, we’ve launched Secrets Validation for Tenable Web App Scanning (WAS). Turn maybe into action You no longer have to manually test every API key or token your scanner unearths. When Tenable WAS identifies a sensitive credential—like a GitHub token—it now goes a step further. Our Validated Secret Detected plugin safely attempts to connect to the service to verify if that secret is live and exploitable. Why this matters for you: Prioritize with confidence: You can stop chasing "dead" keys and focus your remediation efforts on secrets that actually pose a real-world risk. Clear visibility: If a secret is valid, we flag it clearly in your results, giving you the evidence you need to escalate the fix immediately. Broadening coverage: We are continuously expanding validation support across our existing library of detected secrets. How to get started You can find the full setup details in our Secrets Validation documentation. This feature enhances the detection capabilities already found in these key plugins: Generic Secret Disclosure: Credentials for private services. Third-Party Service Secret Disclosure: API keys for public cloud and SaaS platforms. AI Service Secret Disclosure: API keys for public AI services.
New Dell OS10 Compliance Plugin and Audit files
Summary Customers can now measure compliance against Dell OS10 devices with new plugin ID Dell OS10 Compliance Checks (275781) on Tenable Vulnerability Management and Nessus. This plugin is published as a part of the Policy Compliance template and will use the existing SSH credential type. The plugin will retrieve all target data using "show" commands and will evaluate actual values against a given audit policy. Three audits implementing the DISA STIG will be released along with the plugin: DISA Dell OS10 Switch Layer 2 Switch STIG v1r1 20 checks DISA Dell OS10 Switch NDM STIG v1r1 39 checks DISA Dell OS10 Switch Router STIG v1r1 42 checks These audits contain a total of 101 checks. Some examples include: OS10-NDM-000010 The Dell OS10 Switch must limit the number of concurrent sessions to an organization-defined number for each administrator account and/or administrator account type. OS10-NDM-000410 The Dell OS10 Switch must enforce password complexity by requiring that at least one uppercase character be used. OS10-L2S-000240 The Dell OS10 Switch must not use the default VLAN for management traffic. OS10-RTR-001040 The Dell OS10 Router must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces. Additional Notes For those that are interested in creating custom audit content for their environment, please see the plugin documentation for all supported keywords and uses at https://docs.tenable.com/nessus/compliance-checks-reference/Content/dell-os10.htm. Target Release Date Nessus/Tenable.VM - Immediate Tenable.sc - To be determined
Improvement: Handling Component Installs for Vulnerability Assessment
Background On Friday, February 6, 2026, Tenable Research published a plugin update that changed the way component installs are assessed for vulnerabilities. Those changes are outlined in a previous release highlight: Component Installs Require Paranoid Checks, This update essentially reverts this change, while adding new functionality to allow users to choose whether or not they want component installs assessed for vulnerabilities. Component installs are no longer influenced by scan paranoia settings. What are “Component Installs”? Software components, such as applications or language modules/libraries, are installed and managed by a primary "parent" package or application. The crucial point is that these components often cannot be updated individually. Instead, their vulnerability assessment and upgrade are entirely dependent on an update of the parent package. For instance, the SQLite database component is installed as part of the Trend Micro Deep Security Agent and is updated only when the Agent itself is updated. Nessus uses several factors to determine if a detected product is a component, or a standalone installation, including: Was the product installed by a package manager? These products are not considered components, as they are managed by the package manager and not a “parent” application Is the component a “language library”, i.e. a library or module used by the interpreter of a programming language like Python or Node.js? These enumerated libraries are marked as components by default. Does the product reside in a directory that is recognized for installations that are not component-based? Changes By default, component installs are once again assessed for vulnerabilities, as was the case prior to the release of the aforementioned update. If users wish to turn this setting off, so that component installs will not be assessed by generic vulnerability detection plugins, they can do so via the newly created scan preference. The end result of this change should be that fewer “false positives”, i.e. reported vulnerabilities for components that are “owned” by another application, are shown in scan results. Components with vulnerabilities that cannot be addressed independently of the “parent” application will not show in scan results. However, some customers have expressed a desire to see these vulnerabilities in their scan results anyway, to ensure full awareness of the risk profile of every application in their environment. This is still possible through the updated scan configuration settings. To modify this setting in your scan policy, go to Settings > Assessment > Accuracy > Override Normal Accuracy > Assess component installs for potential vulnerabilities. This setting is ON (checkbox is ticked) by default, so users must enable the Override Normal Accuracy checkbox (which is OFF / unchecked by default) if they wish to disable the setting and ensure that component installs are not assessed by generic vulnerability detection plugins in this scan. Please note that this update makes no other changes to the existing paranoia logic, outside of what is described above. For now, “Managed”, “Managed by OS” and “Backported” installs are still controlled by the Show/Avoid potential false alarms radio button. How can I tell if the detected install is a component or not? In addition to the above, we have also updated the relevant detection plugins so they will show if the component flag is set or not. At present, this includes detection plugins for OpenSSL, Curl, LibCurl, Apache HTTPD, Apache Tomcat, SQLite, Python Packages, Node.js modules and, soon to follow, Ruby and Nuget libraries. Using plugin ID 174788, SQLite Detection (Windows), here is a before and after example of the expected plugin output. Before: After: Expected Impact With the new default setting in place, users should anticipate an increase in vulnerability findings for the products in scope, returning to a level similar to what was observed before the first update. If users do not wish to surface these additional potential vulnerabilities, they should disable the "Assess component installs for potential vulnerabilities” setting. If the new scan preference is disabled, the volume of findings will remain consistent with current levels, when scanning with normal accuracy (paranoia) settings. Affected Plugins 12288, global_settings.nasl (updated to support the new scan policy preference) Any plugin that operates downstream of those in the list below: SQLite: 174788 - sqlite_nix_installed.nasl 171077 - sqlite_win_installed.nasl OpenSSL: 168007 - openssl_nix_installed.nasl 168149 - openssl_win_installed.nasl Curl: 182774 - curl_nix_installed.nasl 171860 - curl_win_installed.nasl LibCurl: 182848 - libcurl_nix_installed.nasl Apache HTTPD: 141394 - apache_http_server_nix_installed.nasl 141262 - apache_httpd_win_installed.nasl Apache Tomcat: 130175 - apache_tomcat_nix_installed.nasl 130590 - tomcat_win_installed.nasl Python Packages: 164122 - python_packages_installed_nix.nasl 139241 - python_win_installed.nasl Node.js Modules: 178772 - nodejs_modules_linux_installed.nasl 179440 - nodejs_modules_mac_installed.nasl 200172 - nodejs_modules_win_installed.nasl Targeted Release Date Tenable Nessus and Vulnerability Management: Monday, March 9, 2026 (ETA 22:30 Eastern Standard Time) Tenable Security Center: Monday, March 16, 2026Improvement to Printer OS Fingerprinting
Updated: April 3, 2026 Summary Scanned printers will now have an OS artefact surfaced in their scan host metadata if the target has been identified as a printer when the “Scan Network Printers” policy option is disabled. This change will not cause any additional asset licenses to be consumed within Tenable VM or Tenable Security Center. Background Printers are notoriously unstable scan targets. Oftentimes, they can behave erratically when scanned, so some users prefer to avoid scanning them altogether. At present, there is a switch in the scan policies to prevent further scanning of a host when it's identified as a printer. To enable this setting, go to Settings -> Host Discovery -> Fragile devices - Scan Network Printers (Currently, this is a checkbox setting, default value “off”). With that said, how can the scanner know the target is a printer if it cannot be scanned? In reality, the scanner still performs very basic fingerprinting (usually via SNMP) in order to gather enough information to make an educated guess at the device type. When the scan target is thought to be a printer, it essentially gets marked as “Host/dead" in the scan KB. When this happens, the scanner will not perform any further active scanning. Changes With this update, the fingerprint used to identify the printer as such, will now be stored in the scan Knowledge Base (KB) so it can be processed by os_fingerprint2.nasl ("Post-scan OS Identification", plugin ID 83349) and surfaced as metadata in the scan result. The relevant policy setting located at Settings -> Host Discovery -> Fragile devices -> Scan Network Printers. With this update, the printer's OS information will now be surfaced if it is available, regardless of the selected value for this setting. Impact Users can now see the OS information for their printer devices that would have otherwise gone unreported if the scan is not configured to “Scan Network Printers”. As plugin ID 83349 generates no plugin output, only an “operating-system” tag will be added to the scan result (and stored in an exported .nessus file). This information will be visible only the in “Host/Asset Details” section of the Tenable product UI, i.e: Tenable Nessus: Scans -> [Folder] -> [Individual Scan Result] - > Host Details -> OS (sidebar) Tenable Vulnerability Management: Explore -> Assets -> [Asset] -> Details -> Operating System Scans -> Vulnerability Management Scans -> [Individual Scan Result] -> Scan Details -> Asset Details -> Operating System Tenable Security Center: Analysis -> IP Summary -> [IP address] -> System Information -> OS Scans -> Scan Results -> [Individual Scan Result] -> IP Summary -> [IP address] -> System Information -> OS Note, we expect this information to surface mainly in individual scan results. It would only be present in cumulative asset details if a licensed asset already exists for the target in question. This update will not cause additional assets to be created or consume any additional licenses. Affected Plugins 83349 - os_fingerprint2.nasl 11933 - dont_scan_printers.nasl 22481 - dont_scan_settings.nasl Targeted Release Date Wednesday, March 4, 2026Compliance Windows Command Execution Enhancement
Summary The Windows Compliance Check plugin is implementing an updated library to run commands on Windows targets. The enhancements will include the following benefits. The plugin will improve on its handling of command timeouts. There were issues when long running commands would timeout on the scanner but leave temporary files on the target. This update will force long running checks to close when timing out and remove temporary files. The recently released improved resource management controls for Windows plugins on agents will now be extended to running audits. Potential Impacts: Tenable has gone to great lengths to ensure that the content that it publishes will operate and produce the same results that it always has. Customized audits may exhibit some changes due to the introduced job control of the command execution. These changes tend to be compliance checks that generate different results (failure instead of passing), or the actual values of the check have different text that would affect baseline scans. If custom content does exhibit these issues, strategies to work with the new library can be found in Compliance WMI Library Enhancement. Tenable Plugins 21156 - Windows Compliance Checks Target Release Date February 9, 2026Improvements to Live Kernel Patching Detection
Summary Tenable has improved Live-Patched Kernel detection to include KernelCare. Change Tenable has improved the logic used to detect live-patched kernels to include the running kernel to support KernelCare for Alma Linux, CentOS, CentOS Stream, Fedora, Oracle Linux, Red Hat Linux, and Ubuntu Linux. Impact Upon release, customers using KernelCare will have the running kernel properly detected and referenced during vulnerability scans. Plugin output will specify which live-patch technology (KernelCare in this case) was detected and whether the appropriate hotfix is installed. For example: >The specified patch KernelCare hotfix for ELSA-2025-7898 has been installed. Note: Existing Oracle Linux Plugins must be updated to include the new plugin output. This will not affect live patch functionality -- only plugin output. This will occur over time to reduce churn. It is expected that all plugin updates will be complete by February 16, 2026. No plugin updates will be required for the updated support for Alma Linux, CentOS, CentOS Stream, Fedora, Red Hat Linux, or Ubuntu Linux. Target Release Date February 9th, 2026
[GA] Introducing Tenable Plug-in for Jira (On-Prem) Integration v11.0.0
We are excited to announce the release of the Tenable Plug-in for Jira (On-Prem) Integration v11.0.0. Release Date: January 28, 2026 Download: Tenable Plug-in for Jira On-Prem (Atlassian Marketplace) Docs & User Guide: View Documentation Tenable Integrations Page: Tenable Plug-in for JIRA (on-prem) What’s New in v11.0.0? Jira 11 Support: Added full support for Jira 11.x Data Center environments. Modernized Tech Stack: Updated to support Java 21 and Atlassian SDK-9.9.1. Important Compatibility Note: Version 11.0.0 is NOT backward compatible with Jira versions earlier than 11.x. If you are running Jira 9.x or 10.x, we recommend you upgrade to v11. Questions? We're here to help! Reach out to us at connect.tenable.com. Happy Upgrading! – Ahmad Maruf Tenable Ecosystem Product Management
