EUVD-2026-95207
GHSA-4gpr-m24h-pm75
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged TIE account
-
DeliverySubmit crafted input to AD Events Listener
-
ExploitInject OS command (CWE-78)
-
ExecutionCommand executes as SYSTEM on PDCe
-
ImpactFull domain controller / AD compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated low-privileged account on the Tenable Identity Exposure SaaS tenant (PR:L - not remote-unauthenticated), and the Active Directory Events Listener component must be deployed and actively monitoring the domain, with the PDC emulator (PDCe) in scope - this is the specific feature whose unsanitized input handling (CWE-78) enables command injection. Limiting factors: the attacker must already possess credentials to the TIE environment, meaningfully narrowing the attacker population to insiders or those who have already compromised a low-privileged account; however, no user interaction is required (UI:N) and attack complexity is low (AC:L), so once authenticated, exploitation is not gated by special timing or configuration beyond having the AD Events Listener operational. |
| Impact | This is a genuinely high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable flaw requiring only low privileges, no user interaction, and low attack complexity, with both vulnerable-system and subsequent-system impacts rated High (VC/VI/VA and SC/SI/SA all :H) - reflecting that an authenticated low-privileged user of Tenable Identity Exposure can pivot to full SYSTEM-level code execution on the PDC emulator domain controller, the most sensitive node in an Active Directory forest. The description and CVSS are internally consistent: network vector matches the SaaS access model, and PR:L matches the stated 'authenticated, low-privileged attacker.' Key risk-weighting signals are MISSING from the input: no EPSS probability, no CISA KEV listing, and no public POC are provided. Per precision rules the exploitation status is therefore 'no public exploit identified at time of analysis.' The absence of KEV/EPSS/POC does not lower the intrinsic severity - it only means we have no evidence of in-the-wild activity yet. The decisive mitigating factor is that this is a SaaS product reported by the vendor itself (Tenable), so remediation is largely vendor-side and the attacker must already hold valid low-privileged credentials to the TIE tenant, which constrains the realistic attacker population to insiders or those who have already obtained a foothold/credentials. |
| Exploit ScenarioDerived | An attacker holding valid low-privileged credentials to a Tenable Identity Exposure (SaaS) tenant submits crafted input that is passed unsanitized into the Active Directory Events Listener, injecting OS commands (CWE-78). Because the listener component runs with SYSTEM privileges on the PDC emulator, the injected commands execute as SYSTEM on that domain controller, giving the attacker full control of the AD environment. No public proof-of-concept is identified in the provided data, and the low attack complexity (AC:L) with no user interaction (UI:N) means a credentialed attacker could trigger it reliably. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 08, 2026
Command injection in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) lets an authenticated, low-privileged user execute arbitrary operating-system commands as SYSTEM on the primary domain controller emulator (PDCe). Both the vendor CVSS 4.0 vector (9.4) and our independent CVSS 3.1 assessment agree on PR:L with UI:N and changed scope, meaning an attacker who already holds a valid low-privileged tenant account needs no user interaction and faces low attack complexity to pivot from tenant access to domain-controller-level code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact is severe and the barrier of entry is only an existing credential, so this should be treated as a high-priority remediation.
Earlier versions of this analysis (1)
Authenticated low-privileged users of Tenable Identity Exposure (SaaS) can exploit a command injection flaw in the Active Directory Events Listener to execute arbitrary commands with SYSTEM privileges on the primary domain controller emulator (PDCe). The vulnerability has a CVSS score of 9.9 and requires network access to the listener, but no user interaction. No public exploit code or active exploitation has been identified at the time of analysis; however, the impact is severe, and the vendor advisory should be consulted for patches.
RemediationAI
Tenable has published advisory TNS-2026-27 (https://www.tenable.com/security/tns-2026-27), which is the authoritative source for the fix; the available data does not specify an exact patched version, so the patch status is best described as available per the vendor advisory rather than pinned to a release number. Because the vulnerable component is the customer-deployed Active Directory Events Listener, apply the vendor-supplied listener update as soon as it is published rather than assuming the SaaS backend has been silently corrected, and confirm with Tenable support which listener builds are remediated. Until the update is in place, treat tenant credentials as the primary control surface: enforce MFA, audit and shrink the set of accounts that can access the TIE tenant, and remove or disable dormant low-privileged accounts, since a single valid credential is the only prerequisite for exploitation (trade-off: tightens access for legitimate read-only operators). Where the deployment allows it, run the listener on a dedicated member server rather than directly on the PDCe to reduce blast radius, accepting that some event-collection fidelity or timeliness may be lost. Where supported, run the listener service under a least-privileged service account instead of SYSTEM, recognizing that this may break event forwarding and should be validated in a lab first. Complement these with detection-oriented controls: alert on anomalous child processes spawned by the listener service (especially shells such as cmd.exe or powershell.exe), on unexpected outbound traffic from listener hosts, and on unusual replication or credential-access activity against the PDCe. Finally, if a low-privileged tenant account may have been compromised, rotate its credentials and review tenant audit logs before restoring normal access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-78, OS command injection: input processed by the Active Directory Events Listener is not neutralized before being handed to a shell, so attacker-influenced data is interpreted as command syntax rather than as data. The listener is the customer-deployed collection component that sits inside the Active Directory environment (typically on or adjacent to a domain controller) and forwards AD event telemetry to the Tenable Identity Exposure SaaS backend; because the service runs with high privileges on the PDCe, any command it executes inherits SYSTEM rights on the host that holds the authoritative, writable AD database and acts as the domain's time and authentication anchor. That explains the vendor's changed-scope rating (SC:H/SI:H/SA:H in the CVSS 4.0 vector and S:C in our independent vector): the blast radius is not confined to the listener process but extends to the domain, where code execution as SYSTEM on the PDCe is effectively domain compromise (e.g., access to ntds.dit and the ability to mint or abuse privileged credentials). The CPE record cpe:2.3:a:tenable,_inc.:tenable_identity_exposure_(saas):*:*:*:*:*:*:*:* lists all versions of the SaaS product as affected with a wildcard, so the CPE data alone does not narrow the affected builds; the vendor advisory TNS-2026-27 is the authoritative source for component and version specifics. Note that even under a SaaS delivery model the listener is deployed inside the customer's own domain, so the vulnerable code path is likely to require customer-side action rather than being fixed invisibly in Tenable's cloud.
Know when Tenable Identity Exposure Saas gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable SaaS with low-privileged auth (PR:L) and no interaction; vulnerable TIE component yields SYSTEM code execution on a separate component (the PDC domain controller), so S:C with full C/I/A impact.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
3DescriptionCVE.org
A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.
Executive ViewAI
Tenable Identity Exposure (SaaS) contains a critical command injection flaw in its Active Directory Events Listener that can allow an authenticated low-privileged tenant user to execute operating-system commands as SYSTEM on the primary domain controller emulator. Because this bridges ordinary tenant access to domain-controller-level control, a successful attack could undermine identity infrastructure and expose sensitive enterprise systems. No public exploit or confirmed active exploitation was identified at time of analysis, but the absence of a vendor patch makes this a priority risk for organizations using the affected service.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting low-privileged tenant accounts, enforcing least privilege and MFA, disabling or isolating the Active Directory Events Listener where feasible, limiting network access to the PDCe, and monitoring domain controllers for suspicious SYSTEM-level command execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB