Tenable fixes Identity Exposure flaw that runs commands on the domain controller

Tenable fixes Identity Exposure flaw that runs commands on the domain controller

30 October 2026: Tenable has fixed CVE-2026-119314, a critical command injection (CVSS 9.9) in the Active Directory Events Listener of Tenable Identity Exposure that lets an attacker with a low-privileged account run arbitrary commands as SYSTEM on the PDC emulator, the domain controller that holds the primary domain controller role. Versions 3.93.6 and 3.77.18 fix it along with two lesser flaws; Tenable reports no exploitation, but its scoring marks proof-of-concept code as existing.

Fixed versions

Line	Affected	Fixed
3.93	3.93.5 and earlier	3.93.6
3.77	3.77.17 and earlier	3.77.18

The installers are on the Tenable downloads portal, and the on-premises release notes for 2026 list the builds. Tenable credits Takumi Ito with the critical finding.

Three flaws, one of them in the domain's most sensitive seat

The listener that receives Active Directory events is where the critical bug sits. Its vector is network-reachable, needs only low privileges and no user interaction, and changes scope, which is how a product account turns into SYSTEM on a domain controller: in practice, control of the Windows domain. The CVSS v4 score is 9.4. Identity Exposure is installed precisely to watch Active Directory for attack paths, so the component with the most trust in the domain is also the one carrying the flaw.

CVE-2026-119315 (CVSS 4.3) lets a low-privileged user send crafted GraphQL queries that exhaust server resources and slow or stop the service. CVE-2026-119316 (CVSS 4.1) concerns the Windows Secure Relay: when its installation fails, the linking key is written to a local error log that anyone with access to the host can read.

A second fix in four weeks

On 8 October Tenable fixed another command injection in the same product, CVE-2026-106126, rated 9.9, in the SaaS release 3.126.0. That advisory asked customers to uninstall and reinstall the listener after upgrading. TNS-2026-34 gives no such instruction, so the upgrade alone is what Tenable asks for.

Before and after the upgrade

Teams on either line should upgrade the server and check that every installed listener reports the new build. Where an upgrade has to wait, access to the Identity Exposure console and API can be limited to the security staff who need it, since every flaw in this advisory starts from an authenticated account, and a host where a Secure Relay install failed should have its error log checked for the linking key. Tenable is listed in our catalogue as Tenable, Inc., and our identity management software category lists seven products.

Related on TrustList:

• Tenable fixes critical command injection in Identity Exposure SaaS

Sources

• Tenable: TNS-2026-34, Tenable Identity Exposure Versions 3.93.6 and 3.77.18 Fix Multiple Vulnerabilities, 30 October 2026
• ACN CSIRT Italia: Aggiornamenti di sicurezza per prodotti Tenable, 30 October 2026