CVE-2021-20099

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an authenticated, local administrator to run specific Windows executables as the Nessus host. This is different than CVE-2021-20100.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	Nessus Agent	Nessus Agent 8.2.4 and earlier

References

https://www.tenable.com/security/tns-2021-12Vendor Advisory
https://www.tenable.com/security/tns-2021-12Vendor Advisory

Timeline

Published: Jun 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-20104.2Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.50 and prior, 5.7 CVE-2021-201006.7Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an au CVE-2021-201016.1Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim CVE-2021-201028.8Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.CVE-2021-201036.1Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded with CVE-2021-201048.1Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments upl CVE-2021-201056.1Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' parameter.CVE-2021-201066.5Nessus Agent versions 8.2.5 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator CVE-2021-201075.4There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers includ CVE-2021-201087.5Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certifi CVE-2021-201097.5Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to m CVE-2021-20115.9Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.32 and prior and