CVE-2026-106126
Awaiting Analysis Awaiting Analysis - Queue

Command Injection in Tenable Identity Exposure

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Tenable Network Security, Inc.

Description
A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-09
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-106126
EUVD
EUVD-2026-95207

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Tenable, Inc. Tenable Identity Exposure (SaaS) 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-106126 is a command injection vulnerability in Tenable Identity Exposure (SaaS). It affects the Active Directory Events Listener component in versions 3.125.0 and earlier. An authenticated attacker with low privileges can exploit this to run arbitrary commands as SYSTEM on the Primary Domain Controller (PDCe).

Detection Guidance

Detection involves checking the version of Tenable Identity Exposure (SaaS). If your version is 3.125.0 or earlier, the system is vulnerable. Use the admin interface or Tenable's API to verify the installed version.

Impact Analysis

This vulnerability allows attackers to execute commands with SYSTEM privileges on the PDCe. This could lead to full system compromise, unauthorized access to sensitive data, and potential lateral movement within the network. Attackers could install malware, steal credentials, or disrupt services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, and other regulations. Organizations may face legal penalties, data breach notifications, and reputational damage if exploited.

Mitigation Strategies

Upgrade to Tenable Identity Exposure (SaaS) version 3.126.0 or later. After upgrading, run the script Register-TenableIOA.ps1 -Uninstall to uninstall the Active Directory Events Listener. Then reinstall the listener after the upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106126. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart