A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

According to the versions of the qemu packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in     the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either     through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink     race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or     directories, leading to root access. This vulnerability requires an external management layer (e.g.,     libvirt) to trigger the affected code path.(CVE-2026-12080)

Tenable has extracted the preceding description block directly from the EulerOS qemu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1486 advisory.

    This advisory aggregates security fixes for the qemu-kvm SRPM in CIQ LTS 9.2. It addresses 5 CVEs:
    CVE-2024-8612, CVE-2026-12080, CVE-2025-11234, CVE-2023-5088, CVE-2026-48914.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1484 advisory.

    This advisory aggregates security fixes for the qemu-kvm SRPM in CIQ LTS 9.6. It addresses 41 CVEs:
    CVE-2020-14364, CVE-2019-11091, CVE-2021-20221, CVE-2018-12130, CVE-2020-1983, and 36 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in     the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either     through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink     race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or     directories, leading to root access. This vulnerability requires an external management layer (e.g.,     libvirt) to trigger the affected code path. (CVE-2026-12080)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364002	EulerOS 2.0 SP15 : qemu (EulerOS-SA-2026-4013)	Nessus	Huawei Local Security Checks	Local	high
363987	EulerOS 2.0 SP15 : qemu (EulerOS-SA-2026-3947)	Nessus	Huawei Local Security Checks	Local	high
357307	Rocky Linux 9.2 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc Multiple Vulnerabilities (ciqsa-2026_1486)	Nessus	Rocky Linux Local Security Checks	Local	high
354457	Rocky Linux 9.6 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc Multiple Vulnerabilities (ciqsa-2026_1484)	Nessus	Rocky Linux Local Security Checks	Local	critical
327993	Linux Distros Unpatched Vulnerability : CVE-2026-12080	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-12080

high

Tenable Plugins

high

high

high

critical

high