Tenable Operation Technology EUVD-2026-15025

Despite the absence of a CVSS score and EPSS exploitation probability metric, this vulnerability presents a moderate-to-significant real-world risk due to its role as an enabler for reconnaissance and lateral movement. The attack vector is network-based and requires only valid credentials or SSH access to the ostunnel account, making it accessible in many enterprise environments where OT systems are insufficiently segmented. The lack of CVSS and EPSS data does not diminish the concern: information disclosure vulnerabilities are frequently underestimated but form the first phase of advanced attacks. The threat is amplified in OT environments where asset inventory and network topology are sensitive and tightly controlled. Without evidence of public POC code, patch availability, or KEV listing, the exploitation probability appears lower than active exploit scenarios, but the ease of enumeration and reconnaissance value make this a legitimate priority for OT security teams.

An attacker with valid credentials or network access to the Tenable OT SSH interface authenticates as the ostunnel user and uses SSH port forwarding with GatewayPorts enabled to enumerate listening sockets, open ports, and active services on the OT system. This reconnaissance reveals the system's network topology, service architecture, and potential attack surface (e.g., database ports, internal APIs), enabling the attacker to craft a targeted exploit against a discovered service or to plan lateral movement within the OT network. No public POC is documented, but the straightforward SSH enumeration technique makes exploitation low-complexity for adversaries with preliminary network access.