Tenable Identity Exposure Flaw Grants SYSTEM Access to Low-Privileged Attackers Before 3.126.0

Tenable Identity Exposure contains a critical command injection vulnerability that permits authenticated attackers with low privileges to execute arbitrary commands with SYSTEM-level access. The flaw, identified as CVE-2026-106126, affects the software’s Active Directory Events Listener component in the SaaS offering.

In plain English

This vulnerability allows an attacker who has already logged into the system with a basic user account to run unauthorized commands on the server. Because these commands run with SYSTEM privileges, the attacker gains complete control over the underlying infrastructure. This level of access is the highest possible on Windows systems, allowing the attacker to read, modify, or delete any data and install additional malware.

The issue stems from the way the software processes inputs within the Active Directory Events Listener. This component monitors changes in Active Directory, a directory service used by many organizations to manage users and computers. When the listener fails to properly sanitize input, it allows malicious commands to be injected and executed directly on the server.

The background

According to the National Vulnerability Database (NVD), the weakness is classified under CWE-78, which denotes improper neutralization of special elements used in an OS command. This type of flaw often occurs when software passes user-controlled data to system commands without adequate validation.

Tenable, Inc. is the vendor responsible for the Identity Exposure product. The vulnerability impacts versions of the SaaS platform released before version 3.126.0. Organizations running older versions are exposed to this risk. The high severity rating reflects the ease with which an attacker can escalate from a low-privileged account to full system control.

What changes now

Users of Tenable Identity Exposure must verify their current software version immediately. If the installed version is earlier than 3.126.0, the system is vulnerable. Upgrading to version 3.126.0 or later is required to remediate this specific flaw. Until the update is applied, the risk remains active for any authenticated user, regardless of their privilege level.

Security teams should monitor for unusual command execution or privilege escalation attempts within the Identity Exposure environment. Since the attacker needs an existing account, reviewing user activity logs for anomalies may help detect exploitation attempts.

What to do and how to stay safe: Tenable

• Verify the current version of Tenable Identity Exposure and compare it against the affected range (before 3.126.0).
• Apply the vendor’s update to version 3.126.0 or later to patch the command injection flaw.
• Monitor logs for unexpected command executions or privilege escalations from low-privileged accounts.
• Review access controls to ensure only necessary users have authentication to the Identity Exposure platform.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-106126?

The CVSS score is 9.9, which is rated as critical.

Which versions of Tenable Identity Exposure are affected?

Versions prior to 3.126.0 are affected.

What type of vulnerability is this?

It is a command injection vulnerability (CWE-78) in the Active Directory Events Listener.