libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-22 advisory.

  - libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a     pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.
    When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network     transfer operation that was requested by an application could wrongfully reuse an existing SMB connection     to the same server that was using a different 'share' than the new subsequent transfer should. This could     in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place.
    When this happens, the same credentials are used and the server name is the same. (CVE-2026-5773)

  - libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of     them matches the setup. An easy handle that first uses default native CA trust can continue trusting the     native platform store after the application switches that same handle to custom CA material for a later     transfer. (CVE-2026-11564)

  - A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker     could exploit this issue to execute arbitrary commands on the underlying operating system with the     privileges of the service account. (CVE-2026-19682)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8525-1 advisory.

    Harry Sintonen discovered that curl incorrectly handled credentials when following HTTP redirects in     conjunction with .netrc files. An attacker could possibly use this issue to obtain sensitive information.
    This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-11053)

    Hiroki Kurosawa discovered that curl incorrectly handled OCSP stapling responses. A remote attacker could     possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and     Ubuntu 18.04 LTS. (CVE-2024-8096)

    Joshua Rogers discovered that curl had a use-after-free vulnerability when resetting and cleaning up     HTTP/2 stream handles. An attacker could possibly use this issue to cause a denial of service or execute     arbitrary code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10.
    (CVE-2026-10536)

    Quac Tran and Ngoc Hieu discovered that curl incorrectly reused connections when switching authentication     methods to the same host. An attacker could possibly use this issue to obtain sensitive information or     perform unauthorized actions. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-5545)

    Osama Hamad discovered that curl incorrectly reused SMB connections when the target share differed between     transfers. An attacker could possibly use this issue to obtain sensitive information. This issue only     affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-5773)

    Muhamad Arga Reksapati discovered that curl incorrectly forwarded Digest proxy authentication credentials     to a different proxy host. An attacker could possibly use this issue to obtain sensitive information. This     issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-7168)

    It was discovered that curl incorrectly skipped SSH host verification options when using schemeless URLs     with --proto-default. An attacker could possibly use this issue to perform machine-in-the-middle attacks.
    This issue only affected Ubuntu 25.04 and Ubuntu 25.10. (CVE-2026-12064)

    It was discovered that curl did not enforce an upper bound on memory allocated for unacknowledged     WebSocket PING frames. A remote attacker could possibly use this issue to cause a denial of service. This     issue only affected Ubuntu 25.10. (CVE-2026-11586)

    It was discovered that curl could stall indefinitely when a malicious HTTP/3 server sent a continuous     stream of empty UDP datagrams. A remote attacker could possibly use this issue to cause a denial of     service. This issue only affected Ubuntu 25.10. (CVE-2026-11352)

    It was discovered that curl could incorrectly continue trusting a native platform CA store after an     application switched the handle to use custom CA material. An attacker could possibly use this issue to     obtain sensitive information. This issue only affected Ubuntu 25.10. (CVE-2026-11564)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libcurl installed on the remote host is 8.17.0 prior to 8.21.0. It is, therefore, affected by an improper certificate validation vulnerability:

  - An easy handle that first uses default native CA trust can continue trusting the native platform store     after the application switches that same handle to custom CA material for a later transfer.
    (CVE-2026-11564)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
339129	Tenable Security Center < 6.9.0 Multiple Vulnerabilities (TNS-2026-22)	Nessus	Misc.	Combined	critical
334708	Photon OS 5.0: Curl PHSA-2026-5.0-90-0951	Nessus	PhotonOS Local Security Checks	Local	critical
333502	Photon OS 4.0: Curl PHSA-2026-4.0-1061	Nessus	PhotonOS Local Security Checks	Local	critical
326253	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 24.04 LTS / 26.04 LTS : curl vulnerabilities (USN-8525-1)	Nessus	Ubuntu Local Security Checks	Local	high
322999	libcurl 8.17.0 < 8.21.0 Native CA Trust Persist	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-11564

critical

Tenable Plugins

critical

critical

critical

high

critical