Tenable Agent sits on many endpoints, so a path traversal in that layer is more than a local bug. If the agent can be pushed to write outside its own plugin directory, an attacker can turn a patchable product flaw into persistent code execution on managed machines.
Tenable said it fixed CVE-2026-15265, a critical path traversal in Tenable Agent that may allow remote code execution. The same roundup also noted new patches from ESET, Tanium, and Trend Micro, and said there is no evidence of exploitation for these issues.
The main risk is not the individual host. It is the management plane you trust to stay clean, because compromise there can spread across the fleet and leave code running long after the original flaw is closed.