Read the docs
TI-2026-69731 Aliases CVE-2026-106126

Tenable Identity Exposure (SaaS) Command Injection in AD Events Listener

Priority MEDIUM 47CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Tenable Identity Exposure (SaaS) contains a command injection flaw (CWE-78) in its Active Directory Events Listener. An authenticated attacker with low privileges can run arbitrary commands as SYSTEM on the PDCe. The CNA rates it CVSS 4.0 9.4 (CRITICAL). CISA's SSVC data marks technical impact as total and automatable as no, and the vulnerability is not listed in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0219 82nd percentileScored 2026-11-07
Fix Fixed Tenable Identity Exposure (SaaS) (Tenable, Inc.): 3.126.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TenableTenable Identity Exposure (SaaS)before 3.126.03.126.0Patch availableCNA
  • Tenable Identity Exposure (SaaS) VendorTenable Affected before 3.126.0 Fixed in 3.126.0 Patch available CNA

Remediation

Upgrade Tenable Identity Exposure (SaaS) to version 3.126.0 or later, which fixes the issue. Versions before 3.126.0 are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Tenable Identity Exposure (SaaS) (Tenable, Inc.) Fixed in 3.126.0

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-106126

References

Other 1

  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
  • TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2020-08897 Potential XSS vulnerability in jQuery KEVCVSS 3.1MEDIUM 6.9
  • TI-2021-20274 Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier CVSS 3.1CRITICAL 9.8
  • TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
See all 217 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences