CVE-2026-106126: Tenable Identity Exposure (SaaS) OS Command Injection in Active Directory Events Listener
A command injection flaw (CWE-78) in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) lets an authenticated, low-privileged user run arbitrary commands as SYSTEM on the PDCe. The record reports a CVSS base score of 9.9 and lists the product as affected before 3.126.0. The record shows no confirmed exploitation in the sources consulted.
Overview
CVE-2026-106126 is a command injection vulnerability in the Active Directory Events Listener component of Tenable Identity Exposure (SaaS). The record classifies it as OS Command Injection (CWE-78). The vendor advisory referenced by the record is Tenable TNS-2026-27.
Impact
According to the description, an authenticated attacker with low privileges could execute arbitrary commands as SYSTEM on the PDCe (primary domain controller emulator). The reported vector indicates high impact on confidentiality, integrity and availability, and a scope change. The CNA reports a base score of 9.9 (critical).
Affected products and versions
- Tenable Identity Exposure (SaaS): versions before 3.126.0, as listed in the record.
- The record lists no fixed versions. The upper bound of the affected range is 3.126.0, which is the only version string available in the record.
Exploitation status
- The vulnerability is not listed in the CISA KEV catalog in the record.
- The EPSS probability is 0.02015 (percentile 0.80753) as of the record date.
- SSVC fields in the record indicate exploitation 'none' and automatable 'no'.
- No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Review the vendor advisory at Tenable TNS-2026-27 for the authoritative fix guidance and deployment instructions.
- Because this is a SaaS product, confirm with the vendor or your tenant administration whether your environment is already updated to 3.126.0 or later.
- Limit who holds authenticated accounts on the service and review account hygiene, since the attack requires authentication.
- Restrict administrative exposure of directory-integrated components and monitor privileged activity on domain controllers.
Detection guidance
- Review logs from the Active Directory Events Listener and the Identity Exposure platform for unusual process activity or unexpected commands.
- Watch for unexpected child processes spawned by the listener service on domain controllers, at a high level, and for changes to services or scheduled tasks.
- Correlate authentication events from low-privileged accounts with subsequent privileged actions.
Limitations of the available information
- The record does not describe the exact trigger, the affected component internals or any proof-of-concept details, and this analysis does not provide them.
- The record has status 'Awaiting Analysis' and no fixed version field is populated.
- It is unknown from the record whether SaaS tenants have already been updated.
- The second CVSS score of 9.4 in the record is listed by the same providers; its basis is not described in the record.
Frequently asked questions
What is CVE-2026-106126?
It is a command injection vulnerability (CWE-78) in the Active Directory Events Listener of Tenable Identity Exposure (SaaS). The record says an authenticated, low-privileged attacker could run arbitrary commands as SYSTEM on the PDCe.
Which versions are affected?
The record lists the product as affected before 3.126.0. It does not list a separate fixed version, so check the vendor advisory for confirmation.
Is this vulnerability being exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.