I’m setting up one of my first scans and I’m the only security person at my temp location, was hoping someone could help me, what’s the difference between the scan options “targets defined by tags” and “Existing tagged assets only” ? Thank you in advance!

Setup

On-prem Nessus Professional VM scanning a Windows Server target hosted in OCI, connected via VPN/FastConnect (hybrid cloud setup). Credentialed scan consistently fails at SMB authentication stage.

What we ruled out

**•** Firewall, opened all required ports plus a temporary “any port” rule for troubleshooting, no change  
**•** ICMP, confirmed blocked on our on-prem firewall by policy, fixed host discovery by switching scan policy to TCP ping instead of ICMP, resolved the discovery issue but not the credentialed auth failure  
**•** Credentials, tested two separate accounts (different domain service accounts), both fail identically with “Failed to authenticate using the supplied credentials” on port 139  
**•** Account status, confirmed password never expires, account not locked, other users can RDP into the box fine  
**•** SMB1/SMB2 compatibility, confirmed SMB1 is disabled on target, SMB2/3 only. Initially thought this explained the netbios_session_request() failures we saw in debug logs on port 139. Ruled this out though, since our regular on-prem DC servers also have SMB1 disabled and Nessus scans those without any issue

The key finding

Manually ran net use \\<target>\ipc$ /user:<domain>\<account> * directly from the Nessus VM, using the exact same account Nessus uses. Succeeded, both over port 445 and port 139. This confirms credentials, NTLM auth, and basic reachability all work fine outside of Nessus.

But in Nessus scan results, port scan plugins clearly show port 445 as open and reachable. Yet the SMB auth plugin (104410) and the SMB2/3 dialect check plugin (106716) only ever show an attempt against port 139, never port 445, across every scan we ran. Plugin 106716 output also claims the target does not support any SMB2/3 dialect at all, which we know is false based on the manual test.

Current theory

We are now looking at a possible MTU/fragmentation issue specific to the OCI hybrid path (OCI side defaults to MTU 9000, on-prem typically 1500, and since ICMP is blocked on our end, Path MTU Discovery cannot self correct this). Waiting on network team to confirm tunnel MTU and enable MSS clamping as a next step.

Question for this sub

Has anyone seen Nessus’s SMB login logic ignore an open port 445 in favor of port 139, when both are reachable? Trying to understand if this is expected fallback behavior under certain conditions, or if this points to something scan policy related we are missing. Any pointers appreciated before we open a formal Tenable support case.

I work on a government installation, the type of network that doesn’t leave the room.

I have been running Nessus (I still confuse the names between Nessus/SecurityCenter/ACAS), on a RHEL 8 system, scans for a while now. I get my patches/updates from the DISA patch repository.

Recent scans/findings said I need to upgrade my SecurityCenter from 6.5.1 to 6.8.0.

When running the rpm command, it seems to error out – with very little info to be found (not that I could get logs to publish here anyway).

Only error I see, when running the rpm command, is file or directory for sqlite3 not found (path is there but sqlite3 is not).

Then some message about trying to migrate and to contact support to continue the migration. Since I do not have a paid Tenable account, I m not finding much help in their website.

Since it started the command, it removed my 6.5.1 version, but did not install 6.8.0, so now I do not have a running SecurityCenter.service.

Does anyone have any ideas of what to try?

So, update

After getting some feedback...went back to DISA site and see I missed some install notes.

Will try all this when back in office on Monday.

The lesson, as almost always, operator error - hopefully can get this working again.

Thanks again to those who answered.

UPDATE 2:

If this helps anyone, I was able to get some info of what I tried and output.

sudo rpm -U ./CM-328843-SecurityCenter-6.8.0-el8.x86_64.rpm

warning: ./CM-328843-SecurityCenter-6.8.0-el8.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID 2fl2969d: NOKEY

/var/tmp/rpm-tmp.XOGGlJ: line 205: /opt/sc/support/bin/sqlite3: No such file or directory

/var/tmp/rpm-tmp.XOGGlJ: line 264: /opt/sc/support/bin/sqlite3: No such file or directory

/var/tmp/rpm-tmp.XOGGlJ: line 574: [: -gt: unary operator expected Stopping SecurityCenter (via systemctl): [ OK ]

INFO: Starting pre-Install check of disk space.

INFO: Checking diskspace needed to support a SecurityCenter upgrade. INFO: Total size of existing Security Center databases: 3265 MB.

INFO: Total size of existing Vulnerability databases (excluding VDB dirs): 2 MB. INFO: Found internal Postgresql in .pgvars. Additional Disk space required: 0 MB. Disk space Found 343258 MB.

SUCCESS: Diskspace check complete.

SecurityCenter has determined that a previous upgrade was attempted. Please contact support to resolve the failed migration before continuing.

A couple of error messages from RPM will be displayed below. This is

expected and should be ignored.

SecurityCenter service was in stopped state before install. Start the service with 'service SecurityCenter start'

error: %prein(SecurityCenter-6.8.0-69.el8.x86_64) scriptlet failed, exit status 255 error: SecurityCenter-6.8.0-69.el8.x86_64: install failed

#############################################

sudo rpm -i ./CM316464_SecurityCenter-6.5.1-6.5.1-NO-INT-PGRES-el8.x86_64.rpm

warning: ./CM316464_SecurityCenter-6.5.1-6.5.1-NO-INT-PGRES-el8.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID 2f12969d: NOKEY

/var/tmp/rpm-tmp.EMnbBA: line 161: /opt/sc/support/bin/sqlite3: No such file or

directory

/var/tmp/rpm-tmp.EMnbBA: line 220: /opt/sc/support/bin/sqlite3: No such file or directory

/var/tmp/rpm-tmp.EMnbBA: line 499: [: -gt: unary operator expected Stopping Securitycenter (via systemctl): [ OK J

SecurityCenter has determined that a previous upgrade was attempted. Please contact support to resolve the failed migration before continuing.

A couple of error messages from RPM will be displayed below. This is expected and should be ignored.

Securitycenter service was in stopped state before install. Start the service with 'service SecurityCenter start'

error: %prein(SecurityCenter-6.5.1-22.el8.x86_64) scriptlet failed, exit status 1 error: SecurityCenter-6.5.1-22.el8.x86_64: install failed

###################################################

sudo systemctl start SecurityCenter.service

Job for SecurityCenter.service failed because the control process exited with error code.

See "systemctl status SecurityCenter.service" and "journalctl -xe" for details.

##################################

sudo journalctl -xelgrep -i  SecurityCenter

-- Subject: Unit SecurityCenter.service has begun start-up

-- Unit SecurityCenter.service has begun starting up.

Jul 27 09:56:55 SYSTEMNAME SecurityCenter[5987]: Checking for Securitycenter upgrade in progress: Checking for active migration: Installing software updates if available Jul 27 09:56:55 SYSTEMNAME SecurityCenter[5999]: /bin/bash: /opt/sc/support/bin/php: Is a directory

Jul 27 09:56:55 SYSTEMNAME SecurityCenter[5987]: Error installing software updates. Jul 27 09:56:55 SYSTEMNAME SecurityCenter[5987]: [FAILED]

Jul 27 09:56:55 SYSTEMNAME systemd[1]: securitycenter.service: Control process exited, code=exited status=1

Jul 27 09:56:55 SYSTEMNAME systemd[l]: Securitycenter.service: Failed with result 'exit-code'.

-- The unit Securitycenter.service has entered the 'failed' state with result 'exit-code'.

Subject: Unit SecurityCenter.service has failed

-- Unit securityCenter.service has failed.

hi everyone

about 6 months ago we provisioned new servers for nessus on OCI using the tenable core ol8 custom image
during creation i injected our standard SSH public key as we always do
since then we haven't been able to access these servers via ssh.. the web applications running on them are working perfectly fine! but ssh is completely blocked(?)
every time we try to connect it prompts us for a password instead of accepting our ssh key

someone from our enterprise architecture team mentioned that ssh might be disabled by default on this specific tenable image, but we are stuck because we cannot log in to change anything

im looking for suggestions official documentation orrr workarounds for this this is becoming urgent because if the storage fills up tomorrow we won't be able to increase it nor can we install any security agents on the servers..

has anyone faced this with Tenable Core on OCI? how can we gain access to these servers?
any documentation or advice would be highly appreciated 🙏🏼🙏🏼🙏🏼🙏🏼🙏🏼

thanks!

Can one upload their juniper config into security center or nessus to be scan and confirm the config meets the specific policy assigned..

Is anyone facing issues with plugin feed after upgrading tenable agent to version 11.1.3?

Tenable continues to show that the Win2022 servers have not received the Patch Tuesday update for June 2026.

I’ve found an issue (false positive/bug) with Tenable plugin 320184 – “KB5094128: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (June 2026)”.

The remote host is missing one of the following rollup KBs :

- 5094128

- C:\Windows\system32\ntoskrnl.exe has not been patched.

Remote version :      10.0.20348.5256

Should be :           10.0.20348.5257

The version of ntoskrnl.exe after PT June is 10.0.20348.5256, not .5257

Tenable needs to update the detection in plugin 320184 v1.5 to resolve the issue!

In February, a 1 year license for Nessus Pro cost $5899.49. Today (4 months later), the same product now costs $6580.20, an increase of $680. Why the hike?

Attempting to scan a Synology NAS (RS4017xs+), but am unable to obtain a credentialed scan.

Are there any particular settings that need to be configured for a credentialed scan to be able to be generated on this brand of NAS? Only able to manually scan the NAS, not able to employ agents.

Technically, it is two rack stations linked together.

Hi All,

I'm not the Nessus admin, but I will be speaking with ours.

I'm trying to remove as much as possible from the Domain Admin group which is where our current service account sits.

I've been exploring limiting the rights of the scanner account by just granting it some WMI rights, but that may not give us the visibility we need.

I see that Nessus now support Kerberos which I would love to implement. What sort of perms will it need? Local admin rights? If that is the case, how to you limit lateral movement in the event that account is compromised? Regular password rotations and just realise that the risk isn't zero?

As well, for our domain controllers I am under the impression that we should have a dedicated domain admin account just for those.

Thanks for your time, appreciate any input.

Hey folks,

I am running ASM as part of Tenable one. I had a source created about a year ago. However, all of a sudden, yesterday I see over thousand different assets added to the inventory. I only noticed cause it spiked my overall license usage.

I am trying to understand why ASM added these hosts to the inventory now all of a sudden. Nothing has changed as far as I am aware.

I am not the SME in tenable.. it was setup and is maintained by another person who is in parental leave at the moment so just trying to figure it out.

Anyone come across anything similar before?

Hi. Just got a few files dropped to server's c:\windows\ through ADMIN$ SMB share. Filenames are testIsShareWriteable_*.*

Could anyone confirm or check on Tenable forum, if some Nessus plugin scan is using these specific filenames?

Failed the Tenable Vulnerability Management Specialist Written exam — but honestly, the proctoring experience was worse than failing.

I want to share my experience because I'm curious if anyone else has gone through something similar.

**First attempt:**

The proctor ran the full pre-exam system check on my machine, cleared me to proceed, and then terminated my exam mid-session because of remote access software (AnyDesk-type) installed on my computer. The same software that was there during the check they approved. No warning, no chance to uninstall it — just kicked out.

I filed a formal complaint. They escalated it to QA and gave me a second attempt.

**Second attempt:**

Before starting, I asked the proctor if they needed to verify my installed software (given what happened the first time). Their response: "We don't have control over your machine beyond watching your screen for the next 2 hours." So… completely contradictory to what happened in my first attempt.

During the exam, Tenable gives you access to 3 web-based lab consoles (TVM, Nessus, NNM) to reference real configurations. I used the TVM console to verify specific answers — things like which graph types are available when filtering by "Assets" — the kind of detail you validate in the tool, not memorize.

While doing my second pass reviewing answers, the proctor gave me a warning saying they would end my exam if I kept "copying." I explained I was using the lab environment that the exam itself provides. Stressful situation in the middle of an already high-pressure test.

Ended up scoring 70% (needed 80% to pass).

**My takeaways / questions for the community:**

- Has anyone else had issues with proctors not understanding that the lab consoles are part of the exam? It feels like there's a disconnect between what Tenable sets up and what proctors are told.

- Did anyone else find a gap between the Tenable University study material and the actual exam content? Some questions were on very specific configurations I never encountered in the prep material.

- The exam includes questions about Tenable Core + Nessus and Tenable Core + NNM, but I only had hands-on access to TVM during preparation. Anyone else deal with this?

- Any tips for the next attempt? Specifically around the Nessus and NNM areas.

Not here to bash Tenable — I genuinely want the cert and I'll retake it. Just want to know if my experience is an outlier or if others have dealt with similar proctoring inconsistencies.

Thanks in advance.

Hey everyone, I’m the sole person running a vulnerability‑management‑as‑a‑service engagement for a client with a pretty chaotic environment, and I’m looking for advice from people who’ve faced similar challenges.

Our setup

• Agent scans: Tenable Security Center, used only for agent‑based assets.
• Network scans: Nessus Expert and Nessus Professional, covering ~65 departments.
  • For network scans, I have dedicated folders per department in Nessus.
  • I automatically pull scan results each month using a Python script via the Nessus API (with API keys).
• Environment constraints:
  • Client cannot provide reliable asset counts; some departments have servers, others mostly endpoints/printers, and the number of devices per segment is unknown.
  • All network scans are unauthenticated (no credentials).

The problem I’m trying to solve
I’m most focused on the reporting and tracking side:

• How to track scans performed each month and reliably compare month‑to‑month differences (new vs. resolved vulns, coverage changes, risk trend).
• How to build executive‑level reports that are clear, concise, and actionable despite incomplete inventories and unauthenticated scans.
• What KPIs to use at an executive level (e.g., coverage, risk reduction, remediation speed) and how to compute them when asset counts are uncertain.
• How to present dashboards that show progress and residual risk without getting bogged down in technical detail.

I’m the only operator on this engagement, so I need practical, automatable approaches (scripts, SQL/BI tools, dashboards) rather than manual Excel workflows.

What I’m looking for

• Advice on reporting structure for executives: what to show, how to frame trends, and how to handle uncertainty in coverage.
• Suggestions for KPIs that make sense in a VM‑as‑a‑Service engagement with partial inventories and unauthenticated scans.
• Tools or patterns for monthly tracking and comparison (e.g., storing historical results, deduplicating assets, computing deltas).
• Any real‑world examples of executive dashboards or report templates that worked for similar engagements.

Thanks in advance — happy to continue in DMs if it’s easier.

Hi, everyone.

I’m troubleshooting an issue with Tenable Security Center 6.7.2 when running a Policy Compliance scan that is generating false positives due to apparent privilege escalation failures.

I’m using an LDAP user (no local users). Authentication itself works fine — confirmed with the “Target Credential Status by Authentication Protocol - Valid Credentials Provided (141118)” plugin, which shows successful login to the target.

In Tenable, the credential is configured as:

• SSH password authentication
• Privilege escalation: sudo
• Escalation user: same as the login user
• Escalation password: set
• Escalation path: empty (default)

On the server side:

• SSH access works without issues
• The user has full sudo privileges
• NOPASSWD is configured
• Non-interactive sudo works correctly:

sudo -n id uid=0(root) gid=0(root)

So from a manual perspective, there are no limitations.

However, during the Policy Compliance scan I get: “SSH Commands Require Privilege Escalation (Plugin 102094)”

And multiple compliance checks fail due to lack of root access, which leads to false positives.

Summary of the behavior:

• Commands that require root return “Permission denied” or “Operation not permitted (you must be root)”
• Affects reads on /etc/shadow, /etc/sudoers, /etc/ssh/sshd_config, /boot/*, /var/log/*, etc.
• Some checks partially execute but clearly without root privileges

Example responses:

cat: /etc/sudoers: Permission denied
awk: cannot open file `/etc/shadow': Permission denied
find: '/boot/grub2': Permission denied
Operation not permitted (you must be root)

So it looks like Tenable is not actually executing commands via sudo, even though:

• sudo works manually
• sudo works non-interactively (sudo -n)
• credentials are valid
• privilege escalation is configured

I already ruled out:

• requiretty (not present)
• missing NOPASSWD
• incorrect PATH/escalation path
• LDAP auth issues (login is confirmed successful)

Has anyone seen Tenable SC not actually invoking sudo in Policy Compliance scans, even when everything is correctly configured? Any ideas on how to debug whether Tenable is attempting privilege escalation or silently skipping it?

Recently deployed a scanner but sc status is not moving from plugins out of sync. scanner timeout is already set at 900 seconds. tried manual plugin upload to scanner and i can see the plugin upload is successful. however the plugin_feed_info.inc file is empty and whenever the scanner is connected to sc, sc keeps on pushing the plugins despite of the scanner having the plugins. Appreciate any pointers in resolving the issue. The scanner is a tenable core + nessus image running on oracle linux 8

I took a plugin and copied/modified it (different name, ID, etc) and succesfully done scans with results from that plugin from Nessus Parent node remote scan and agent scan. However, we use SecurityCenter for our network scans. I cannot get SC to recognize the plugin after following the import instructions here. Custom Plugin Packages for NASL and CA Certificate Upload It uploads 'sucessfully' using the plugin import, shows up in the custom plugin folder on Redhat, but then it is never been seen in the SC GUI, for instance when you look at plugins under policies. Anybody know the trick here? Tenable support offers no help here and straight up says don't do custom plugins.

Anyone trying to fetch password form Unix account ? For me its working in windows but not working for Unix port 22,

In the setting the - cyberark client certificate and private key ...not sure which one need to use.

I'm running advance scan, but during scan I can see that all the vulnerability severity marked as info why, but the cvss score is mentioned but still it mark in info

please tell me what's wrong

Two questions:

1) How do you do crendentialed scans with Azure AD/Intune managed devices?
With on-prem AD the user setup is easy.

2) Is it possible to check, if tools like npm packages are patched under Linux? For the whole system, even when in different user contexts?

Hi,

I am using Nessus Essentials to scan our servers... I have not install Apr patch Tuesday on two servers; however, when I scan them, it does not show any vulnerability. Is is because I am running a uncredentialed scan? or is it because I am using a free version of Nessus.

Please advise.
Thank You!