Patch & vulnerability status
Nmap Project
Insecure Nmap 7.98
Latest tracked version 7.98. Release status, tracked CVEs, and automated cross-platform patching for Insecure Nmap.
Category: Security
| Platform | Latest version | CVEs tracked | Last checked |
|---|---|---|---|
| Windows | 7.98 | 5 | 2024-12-03 |
Known vulnerabilities (CVEs) in Insecure Nmap
Lavawall tracks 5 published CVEs affecting Insecure Nmap, and deploys the versions that fix them automatically across your fleet.
| CVE | Published | Severity | Details | Vector |
|---|---|---|---|---|
| CVE-2026-58058 | 2026-06-28 02:16:33 | MEDIUM (7) | Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans. | NETWORK |
| CVE-2018-15173 | 2018-08-08 00:29:02 | MEDIUM (5) | Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted TCP-based service. | NETWORK |
| CVE-2018-100016 | 2018-04-18 19:29:01 | LOW (4) | nmap version 6.49BETA6 through 7.60, up to and including SVN revision 37147 contains a Directory Traversal vulnerability in NSE script http-fetch that can result in file overwrite as the user is running it. This attack appears to be exploitable via a victim that runs NSE script http-fetch against a malicious web site. This vulnerability appears to have been fixed in 7.7. | NETWORK |
| CVE-2017-18594 | 2019-08-29 00:15:10 | MEDIUM (5) | nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n character to ssh-brute.nse or ssh-auth-methods.nse. | NETWORK |
| CVE-2013-4885 | 2013-10-26 17:55:03 | MEDIUM (7) | The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences. | NETWORK |
Why keeping Insecure Nmap patched matters
Unpatched third-party applications are one of the most common ways attackers get in: 57% of breached MSP clients and 32% of ransomware cases trace back to a missing patch. Every Insecure Nmap release that fixes a security bug is public, so attackers see it too, and an out-of-date install becomes a documented way in. Tracking the installed version on every machine and closing the gap quickly is what turns a disclosed CVE into a non-event.
How Lavawall® patches Insecure Nmap
Lavawall® watches Insecure Nmap releases and CVEs continuously, ranks each update by risk, and deploys it across your whole fleet, Windows, macOS, and Linux, from a single agent, independently of your RMM. You get one place to see which machines are behind on Insecure Nmap, one policy to bring them current, and timestamped evidence for audits.
Frequently asked questions
Lavawall tracks Insecure Nmap at version 7.98 (last checked 2024-12-03). New releases are monitored continuously and can be deployed automatically across your fleet.
Lavawall tracks 5 CVEs for Insecure Nmap and remediates them automatically as part of patching.
Deploy the Lavawall® agent and Insecure Nmap updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Lavawall® monitors releases and CVEs for Insecure Nmap through public information and proprietary statistical analysis, and can patch it automatically across your fleet.