CVE-2026-119314CVSS 9.9AD events-listener command injection
An authenticated low-privileged attacker with write access to IoA configuration can run commands as SYSTEM on the PDC emulator; score is CVSS 3.1.
Tenable Identity Exposure fixes SYSTEM command injection in its AD events listener
Tenable Identity Exposure fixes three flaws, including authenticated command injection that can run as SYSTEM on the PDC emulator. Upgrade to 3.93.6 or 3.77.18, then uninstall and reinstall the IoA script on domain controllers: upgrading alone retains the vulnerable listener.
- Disclosed
- Oct 30, 2026
- Public disclosure date
- Severity
- CVSS 9.9 × 1
- 3 CVEs tracked here
- Splash zone
- Identity Exposure <=3.93.5 / <=3.77.17; command injection requires an authenticated account with IoA configuration write access
- Active Directory · Tenable · RCE
- In the wild
- Unknown
- The advisory reports fixes, not confirmed real-world exploitation.
What happened
The primary advisory lists versions 3.93.5 and earlier and 3.77.17 and earlier as affected. The release notes narrow the command-injection prerequisite to an account able to write the IoA configuration; this is not an unauthenticated domain-controller takeover. The advisory gives CVSS 3.1 scores of 9.9, 4.3 and 4.1, and separate CVSS 4.0 scores of 9.4, 5.3 and 5.6.
Both fixed-release notes require the post-upgrade IoA uninstall/reinstall and warn about custom RSA certificates below 2048 bits. They also describe a separate internal-request error-message disclosure fix without assigning another CVE on this advisory page. No exploitation, victim count or incident-specific indicator list is provided. Review permissions and credential exposure as well as the installed product version.
What’s in the bowl
CVE-2026-119315CVSS 4.3GraphQL resource exhaustion
An authenticated low-privileged user can submit queries that consume excessive server resources; CVSS 3.1.
CVE-2026-119316CVSS 4.1Secure Relay linking-key log disclosure
Failed Secure Relay installation writes its linking key to a local error log readable by a user with host access; CVSS 3.1.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Identity Exposure 3.93 | 3.93.6 | Patched; IoA script reinstall also required |
| Identity Exposure 3.77 | 3.77.18 | Patched; IoA script reinstall also required |
Crime-scene timeline
Oct 30, 2026
TNS-2026-34 and both fixed releases published
Release notes require reinstalling the IoA script after upgrading and checking custom TLS certificate key sizes beforehand.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.