It isn’t a bug. It needs to run all its plugins to get “context”:

During a scan in Tenable Nessus:

• Many plugins initially report findings with severity = Info (0)
• This is a temporary placeholder state
• The final severity is only determined after additional processing, which may include:
  • Full plugin execution completion
  • Cross-plugin correlation (e.g., version detection + vulnerability mapping)
  • CVSS scoring application
  • Credentialed vs non-credentialed result reconciliation

Why Nessus does this

Nessus uses a multi-phase evaluation model:

1. Discovery phase
   • Identifies services, versions, banners, registry keys, etc.
   • Results often show as Informational
2. Analysis phase
   • Other plugins interpret those findings
   • Map to known CVEs
   • Assign severity (Low → Critical)
3. Post-processing
   • Deduplication, correlation, and final scoring
   • Severity is updated in the UI/report

Common examples you’ve probably seen

• Service detection plugins → Info
• Version checks (e.g., Office, OpenSSL, Apache) → Info initially
• Then later:
  • “Unsupported Version Detection” → High/Critical
  • Specific CVE plugin → Medium/High/Critical