I’M UNDER A CYBER ATTACK

Alert

Alert 2026-134 Critical flaw in Tenable Identity Exposure exposes the domain controller

Affected product(s): 

ProductAffected versionsFixed version
Tenable Identity Exposure (on-premises), 3.93 branch3.93.5 and earlier3.93.6
Tenable Identity Exposure (on-premises), 3.77 branch3.77.17 and earlier3.77.18
Tenable Identity Exposure (SaaS), CVE-2026-1061263.125.0 and earlier3.126.0

In all cases, the update does not replace the Indicators of Attack (IoA) listener already installed on domain controllers, which must be uninstalled and reinstalled.

Description

A critical-severity vulnerability (CVSSv3.1 9.9 – CRITICAL; CVSSv4 9.4) has been disclosed in Tenable Identity Exposure, Tenable’s solution for monitoring Active Directory security (formerly Tenable.ad), which allows an attacker authenticated with low privileges to execute arbitrary commands as SYSTEM on the domain controller holding the PDC emulator (PDCe) role. The vulnerability has been tagged as CVE-2026-119314 and is of the OS command injection type (CWE-78).

The flaw is located in the Active Directory Events Listener, the component of the Indicators of Attack (IoA) module that is deployed via a GPO on domain controllers. According to the vendor, an account with write permission on the IoA configuration in the Tenable Identity Exposure console can cause the listener to execute commands as SYSTEM on the domain controller. Because the PDCe is a domain controller, exploitation is equivalent to compromising the Active Directory domain.

The same flaw affected the SaaS version of the product, where it was identified as CVE-2026-106126, with the same score, and was fixed in version 3.126.0, released on 10/08/2026. On 10/30/2026, the vendor published the fix for both on-premises branches. Although SaaS instances are updated on the vendor side, the listener installed on domain controllers remains vulnerable until it is reinstalled.

The on-premises update also fixes two lower-severity vulnerabilities:

CVETypeCVSSComponent
CVE-2026-119314Command injection (CWE-78) allowing commands to be executed as SYSTEM on the PDCeCVSSv3.1 9.9 – CRITICAL (CVSSv4 9.4)Active Directory Events Listener (IoA)
CVE-2026-119315Denial of service due to excessive resource consumption (CWE-770) through manipulated queries by an authenticated user with low privilegesCVSSv3.1 4.3 (CVSSv4 5.3)GraphQL API
CVE-2026-119316Exposure of sensitive information in logs (CWE-532): a failed installation writes the linking key to the local error logCVSSv3.1 4.1 (CVSSv4 5.6)Secure Relay for Windows

The vendor has not reported active exploitation; none of the vulnerabilities is listed in the U.S. cybersecurity agency’s Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code has been identified.

Mitigation

No official temporary mitigation exists. While the update is being applied, we recommend minimizing the number of accounts and roles with permission to modify the IoA configuration and restricting access to the Tenable Identity Exposure console.

Detection and exposure verification

The vendor has not published indicators of compromise or detection rules. General recommendations:

  • Identify the version of each on-premises instance and confirm that the IoA listener on domain controllers has been reinstalled after the update (for SaaS, after 10/08/2026).
  • Review which console users and roles have permission to modify the Indicators of Attack configuration, as well as recent changes to that configuration.
  • On the PDCe, review the execution of unusual processes started by the IoA listener.
  • In Active Directory, review account creations and changes to privileged groups that cannot be justified.

Solution

The solution is to update each on-premises instance to the fixed version of its branch, available in the vendor’s download portal:

  • 3.93 branch: 3.93.6.
  • 3.77 branch: 3.77.18.

Before updating, we recommend verifying that custom TLS certificates and their CA use RSA keys of at least 2048 bits, as both versions install Node.js 24, which rejects shorter keys.

After updating (and, for SaaS, from version 3.126.0), the IoA listener on domain controllers must be uninstalled and reinstalled, because the update by itself leaves the vulnerable listener in place:

  1. Run Register-TenableIOA.ps1 -Uninstall. The script creates a cleanup GPO and waits 4 hours for it to replicate throughout the domain.
  2. Delete the cleanup GPO with Remove-GPO -Guid <GUID> -Domain "<DOMAIN>".
  3. Download the new IoA installation script from the console and run it to install the fixed listener. Running the new script without first uninstalling the previous listener leaves the previous listener in place.

For information on how to update, visit the following link:

https://www.tenable.com/security/tns-2026-34

Additional information: