CVE-2026-106126

CriticalCVSS 9.9

Published: 08/10/2026(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Summary

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.

Risk Assessment

A low-privileged attacker could escalate privileges to SYSTEM, potentially leading to full compromise of the domain controller and the entire domain.

Recommendation

Apply security patches from Tenable and restrict user privileges and monitor activity on the PDCe.

Other vulnerabilities in Tenable Identity Exposure

CVE-2026-13007High
Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and serve sensitive data to unauthenticated users.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS