Vulnerability in Tenable, Inc. Tenable Identity Exposure (SaaS)

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.9

[ Description ]Official description

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.

[ Fixes ]Fixes and patches

• Security bulletin: Tenable tns-2026-27Vendor patch or bulletin · CERT-FR · tenable.com/security/tns-2026-27, cited by CERT-FR CERTFR-2026-AVI-1284

[ Advisories ]Government CERT advisories

• CERT-FR9 Oct 2026CERTFR-2026-AVI-1284

  Vulnerability in Tenable products Translated from French

  A vulnerability has been discovered in Tenable products. It allows an attacker to cause remote arbitrary code execution. The vendor states that a component must be reinstalled after the update.

  CVE-2026-106126

[ References ]References

• www.tenable.com/security/tns-2026-27