The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing     the identical response message, received twice. The first thread, A, runs. While it's running, the second     one, B, gets partway through, and during that slow calculation, or even while blocking on down_write(), A     completes and then also a handshake initiation that's already been queued up runs in thread C, which     itself takes that same down_write(). The handshake initiation creation succeeds, and sets the state back     to waiting-for-response, and calls up_write(), at which point thread B resumes, because either its     finished its calculations or was finally allowed to acquire down_write(). Thread B then copies the state     back to the peer, and begins a new session, using that state, which is the same session as the one made in     thread A. Thread A Thread B Thread C down_read() sA = handshake->state memcpy(cA, handshake->crypto)     up_read() if (sA != 1) goto fail slow_crypto(cA) down_read() sB = handshake->state memcpy(cB,     handshake->crypto) up_read() if (sB != 1) goto fail slow_crypto(cB) down_write() if (sA !=     handshake->state) goto fail memcpy(handshake->crypto, cA) handshake->state = 2 up_write() down_write() if     (handshake->state != 2) goto fail derive_session(handshake->crypto) up_write() down_write()     slow_crypto(handshake->crypto) handshake->state = 1 up_write() down_write() if (sB != handshake->state)     goto fail memcpy(handshake->crypto, cB) handshake->state = 2 up_write() down_write() if (handshake->state     != 2) goto fail derive_session(handshake->crypto) up_write() This seems basically impossible to hit in a     meaningful way in practice, but ensure that it absolutely cannot happen by comparing the ephemeral private     key that's on the stack with the latest one that the peer's handshake state has. (CVE-2026-99059)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-99059

high Nessus Plugin ID 371505

Version 1.12

Version 1.11

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.12 Nov 13, 2026, 4:53 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202611131653
Version 1.11 Nov 13, 2026, 9:54 AM CVSS metrics ("CVSSv2 score" set to 7.3. "CVSSv2 vector" set to "CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:P") Plugin Feed: 202611130954
Version 1.10 Nov 12, 2026, 7:08 AM CVSS metrics ("CVSSv2 score" set to 7.8. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202611120708
Version 1.9 Nov 9, 2026, 3:50 PM CVSS metrics ("CVSSv2 score" set to 7.3. "CVSSv2 vector" set to "CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:P") Plugin Feed: 202611091550
Version 1.8 Nov 7, 2026, 10:50 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202611071050
Version 1.7 Nov 7, 2026, 4:01 AM CVSS metrics ("CVSSv2 score" set to 7.8. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202611070401
Version 1.6 Nov 2, 2026, 8:29 AM CVSS metrics ("CVSSv2 score" set to 7.3) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:P") Plugin Feed: 202611020829
Version 1.5 Oct 31, 2026, 12:23 PM CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610311223
Version 1.4 Oct 28, 2026, 8:56 AM CVSS metrics ("CVSSv2 score" set to 7.3. "CVSSv2 vector" set to "CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:P") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610280856
Version 1.3 Oct 27, 2026, 4:13 PM CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610271613
Version 1.2 Oct 27, 2026, 9:59 AM CVSS metrics ("CVSSv2 score" set to 7.3) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:P") CVSS metrics ("CVSSv3 score" set to 7.7) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L") Plugin Feed: 202610270959
Version 1.1 Oct 24, 2026, 2:50 AM New Plugin Feed: 202610240250