A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_88421 advisory.

    * qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-     keys (CVE-2026-12080)

    Bug Fix(es) and Enhancement(s):

    * qemu-img can't create a qcow2 overlay with 'data_file' feature on top of a file without destroying the     original image [rhel-9.8.z] (JIRA:Rocky Linux-164549)

    * live migration of a VM with a scsi3pr to a node that previously held a reservation on that disk fails.
    [rhel-9.8.z] (JIRA:Rocky Linux-280223)

    * Fix pending QEMU issues for L1VH GA - QEMU [rhel-9.8.z] (JIRA:Rocky Linux-283121)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:88421 advisory.

    * qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-     keys (CVE-2026-12080)

    Bug Fix(es) and Enhancement(s):

    * qemu-img can't create a qcow2 overlay with 'data_file' feature on top of a file without destroying the     original image [rhel-9.8.z] (JIRA:Rocky Linux-164549)

    * live migration of a VM with a scsi3pr to a node that previously held a reservation on that disk fails.
    [rhel-9.8.z] (JIRA:Rocky Linux-280223)

    * Fix pending QEMU issues for L1VH GA - QEMU [rhel-9.8.z] (JIRA:Rocky Linux-283121)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:88421 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    Security Fix(es):

    * qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-     keys (CVE-2026-12080)

    Bug Fix(es) and Enhancement(s):

    * qemu-img can't create a qcow2 overlay with 'data_file' feature on top of a file without destroying the     original image [rhel-9.8.z] (JIRA:RHEL-164549)

    * live migration of a VM with a scsi3pr to a node that previously held a reservation on that disk fails.
    [rhel-9.8.z] (JIRA:RHEL-280223)

    * Fix pending QEMU issues for L1VH GA - QEMU [rhel-9.8.z] (JIRA:RHEL-283121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the qemu packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in     the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either     through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink     race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or     directories, leading to root access. This vulnerability requires an external management layer (e.g.,     libvirt) to trigger the affected code path.(CVE-2026-12080)

Tenable has extracted the preceding description block directly from the EulerOS qemu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1486 advisory.

    This advisory aggregates security fixes for the qemu-kvm SRPM in CIQ LTS 9.2. It addresses 5 CVEs:
    CVE-2024-8612, CVE-2026-12080, CVE-2025-11234, CVE-2023-5088, CVE-2026-48914.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1484 advisory.

    This advisory aggregates security fixes for the qemu-kvm SRPM in CIQ LTS 9.6. It addresses 41 CVEs:
    CVE-2020-14364, CVE-2019-11091, CVE-2021-20221, CVE-2018-12130, CVE-2020-1983, and 36 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in     the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either     through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink     race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or     directories, leading to root access. This vulnerability requires an external management layer (e.g.,     libvirt) to trigger the affected code path. (CVE-2026-12080)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
371680	Rocky Linux 9 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc (crlsa-2026_88421)	Nessus	Rocky Linux Local Security Checks	Local	high
371134	RockyLinux 9 : qemu-kvm (RLSA-2026:88421)	Nessus	Rocky Linux Local Security Checks	Local	high
370900	RHEL 9 : qemu-kvm (RHSA-2026:88421)	Nessus	Red Hat Local Security Checks	Local	high
364002	EulerOS 2.0 SP15 : qemu (EulerOS-SA-2026-4013)	Nessus	Huawei Local Security Checks	Local	high
363987	EulerOS 2.0 SP15 : qemu (EulerOS-SA-2026-3947)	Nessus	Huawei Local Security Checks	Local	high
357307	Rocky Linux 9.2 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc Multiple Vulnerabilities (ciqsa-2026_1486)	Nessus	Rocky Linux Local Security Checks	Local	high
354457	Rocky Linux 9.6 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc Multiple Vulnerabilities (ciqsa-2026_1484)	Nessus	Rocky Linux Local Security Checks	Local	critical
327993	Linux Distros Unpatched Vulnerability : CVE-2026-12080	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-12080

high

Tenable Plugins

high

high

high

high

high

high

critical

high