Tenable Identity Exposure Patched for Critical Command Injection Flaw

Tenable has released a security update for its Identity Exposure (SaaS) product to fix a critical command injection vulnerability that could allow attackers to execute arbitrary commands with system-level privileges. The flaw, tracked as CVE-2026-106126, affects versions of the software prior to 3.126.0 and has been assigned a CVSS score of 9.9 by the National Vulnerability Database.

The vulnerability resides within the Active Directory Events Listener component of the Tenable Identity Exposure platform. According to the NVD record, the weakness is classified under CWE-78, indicating improper neutralization of special elements used in an OS command. An authenticated attacker with low-privileged access can exploit this flaw to execute arbitrary commands on the Primary Domain Controller emulator (PDCe) with SYSTEM-level rights. This level of access grants the attacker complete control over the affected system, potentially leading to data theft, service disruption, or further lateral movement within the network.

Technical Context and Severity

The National Vulnerability Database rates CVE-2026-106126 as Critical, reflecting the high impact of successful exploitation. The CVSS score of 9.9 indicates that the vulnerability requires only low complexity and low privileges to exploit, yet results in total loss of confidentiality, integrity, and availability.

The specific attack vector involves the Active Directory Events Listener, a component designed to monitor and process events within an Active Directory environment. By injecting malicious commands into this listener, an attacker can bypass normal application controls. The resulting execution occurs as the SYSTEM account on the PDCe, a critical role in Windows domain environments. This means that an attacker does not need high-level administrative credentials initially; low-privileged access is sufficient to trigger the exploit and gain full system control.

Tenable, the vendor behind the Identity Exposure product, has addressed the issue in version 3.126.0. Customers running earlier versions are advised to update immediately to mitigate the risk. The release of this patch closes the window for exploitation, but organizations must verify their current software versions to ensure they are protected.

Who Is Affected

This vulnerability specifically impacts organizations using Tenable Identity Exposure (SaaS). The SaaS nature of the product means that the infrastructure is managed by Tenable, but the configuration and access controls are determined by the customer. Any entity using the service with a version prior to 3.126.0 is potentially vulnerable.

The risk is heightened for environments where low-privileged users have access to the Identity Exposure interface. Since the exploit requires authentication, attackers who have compromised a low-level account within the organization can leverage this vulnerability to escalate their privileges significantly. This makes it a critical concern for organizations that have experienced credential theft or weak authentication practices, as it provides a direct path from a low-privilege foothold to full system compromise.

What should you do?

Organizations using Tenable Identity Exposure should immediately verify their current software version. If the version is below 3.126.0, apply the latest update as soon as possible. Monitor Active Directory logs for unusual command executions or unexpected SYSTEM-level activities, which could indicate exploitation attempts. Review access controls for the Identity Exposure platform to ensure that only necessary users have access, reducing the attack surface for potential exploitation.