Skip to main content
protocols.pageprotocols.page
8834

Port 8834 – Nessus

TCP

Port 8834 is the Nessus vulnerability scanner web interface and API port. Nessus serves its management console over HTTPS on port 8834. The scanner contains detailed vulnerability findings for your infrastructure – exposing port 8834 leaks your entire vulnerability posture to attackers. Restrict to security team IPs only.

Port Number

8834

Protocol

TCP

Service

Nessus Vulnerability Scanner

Range

IANA Registered (1024–49151)

Description

Tenable Nessus on port 8834 provides the web UI for configuring scans, viewing vulnerability results, and managing scanner policies. The REST API on the same port enables automation and integration with SIEM/ticketing systems. A Nessus instance contains the most sensitive security data in an organization – every known vulnerability across all scanned hosts. An attacker who accesses port 8834 gets a prioritized attack roadmap for your infrastructure. Use strong passwords (Nessus does not support SSO by default), restrict port 8834 via firewall to security team IPs, enable HTTPS with a valid certificate, and audit API key usage.

Security risks

  • 1Nessus on port 8834 contains your complete vulnerability inventory – every CVE, every misconfiguration, every weak credential across all scanned hosts. An attacker with access has a prioritized attack roadmap
  • 2CVE-2018-20843: Stored XSS in Nessus web UI allowed session hijacking through crafted scan names – attackers could steal admin session tokens via the port 8834 interface
  • 3CVE-2023-3251: Nessus credential disclosure – API keys exposed in HTTP responses on port 8834 allowed unauthorized scan access without valid login
  • 4CVE-2023-6062: Nessus stored XSS via scan policy names – persistent JavaScript execution in the context of other users viewing scan results on port 8834
  • 5Default self-signed certificate on port 8834 enables MITM attacks against security teams – attackers intercept vulnerability data in transit
  • 6Nessus REST API on port 8834 allows programmatic scan launching – compromised API keys enable scanning internal networks from a trusted source
  • 7No rate limiting on login attempts by default – brute force against port 8834 authentication is trivial without fail2ban or WAF

Firewall guidance

Restrict port 8834 exclusively to security team IP ranges using host-based firewall. Never expose to the internet – Shodan indexes thousands of exposed Nessus instances. Use VPN or bastion host for remote access. Deploy a valid TLS certificate (not self-signed) to prevent MITM on vulnerability data. Enable Nessus advanced settings: max login attempts, session timeout, IP-based access control list.

Diagnosis commands

Check Nessus server status and version (unauthenticated endpoint) – confirms the service is running

shell
curl -sk https://localhost:8834/server/status

Query Nessus properties including license type, scanner version, and plugin feed status

shell
curl -sk https://localhost:8834/server/properties

Show Nessus listener configuration including bound address and port

shell
nessuscli fix --list | grep listen

List all Nessus user accounts – audit for default/unused accounts that should be removed

shell
nessuscli lsuser

Verify Nessus is bound to expected interface (should be 127.0.0.1 or management IP, never 0.0.0.0)

shell
ss -tlnp | grep 8834

Usage examples

Port 8834 – Nessus
shell
curl -k https://localhost:8834/server/status
nessuscli fix --set listen_port=8834
iptables -A INPUT -p tcp --dport 8834 -s SECURITY_TEAM_SUBNET -j ACCEPT

Common services on this port

Tenable Nessus Professional (standalone scanner)Tenable Nessus Manager (multi-scanner orchestration)Tenable Nessus Agent (host-based scanning)Nessus REST API (automation/integration)Legacy SecurityCenter scanner endpoints

Related ports

8835

Nessus Agent (newer versions)

443

Tenable.io cloud platform

8443

Tenable Security Center

9390

OpenVAS/GVM (GVMD)

9392

OpenVAS GSA web UI

History

Nessus was created by Renaud Deraison in 1998 as an open-source vulnerability scanner. Port 8834 was introduced when Nessus moved from a client-server model (NTP protocol on port 1241) to a web-based interface in Nessus 4.2 (2009). Tenable made Nessus closed-source in 2005, prompting the OpenVAS fork. The web UI on port 8834 unified scan management, reporting, and API access into a single HTTPS service. By 2024, Nessus Professional remains the most widely deployed commercial vulnerability scanner, with port 8834 being one of the highest-value targets in any network – it literally contains the list of every weakness an attacker could exploit.

FAQ

Why is an exposed Nessus instance so dangerous?

Nessus on port 8834 contains your complete vulnerability inventory: every unpatched CVE, every misconfigured service, every weak credential across all scanned hosts. An attacker who accesses it gets a sorted list of exactly which hosts to attack and how. It is literally a prioritized attack playbook. This is why exposed Nessus instances are traded on darknet forums.

How do I secure Nessus port 8834?

1) Bind to management interface only (nessuscli fix --set listen_address=MGMT_IP). 2) Firewall port 8834 to security team IPs only. 3) Replace self-signed cert with valid TLS certificate. 4) Enable advanced security settings (max login attempts, session timeout). 5) Use API keys with minimal permissions. 6) Audit user accounts monthly. 7) Access via VPN only for remote teams.

Can Nessus API keys be rotated?

Yes – in the Nessus web UI on port 8834 go to Settings → My Account → API Keys → Generate. Old keys are immediately invalidated. Automate rotation via the REST API: POST /session to authenticate, then PUT /settings/api-key. Embed keys in secrets managers (HashiCorp Vault, AWS Secrets Manager) rather than hardcoding in scripts.