Summary
- CVE-2026-106126 affects Tenable Identity Exposure SaaS 3.125.0 and earlier.
- Tenable says a low-privileged authenticated attacker can execute commands as SYSTEM on the PDC emulator.
- Existing installations need listener removal and reinstallation after upgrading.
Tenable has patched a critical command injection vulnerability in its Identity Exposure software that could allow a low-privileged authenticated attacker to execute commands with SYSTEM privileges on a Windows domain controller performing the primary domain controller emulator role.
The company published advisory TNS-2026-27 on 8 October 2026, identifying CVE-2026-106126 in the Active Directory Events Listener used by Tenable Identity Exposure SaaS. The vulnerability affects versions 3.125.0 and earlier, according to the vendor, and is addressed by version 3.126.0.
The flaw carries a CVSS 3.1 base score of 9.9 and a CVSS 4 score of 9.4. Those ratings describe severity under the relevant scoring systems; they do not establish that attackers have exploited the vulnerability. The prerequisite of an authenticated, low-privileged account should also remain explicit, rather than presenting this as unauthenticated internet access to a domain controller.
The affected listener monitors events in an Active Directory environment. Its location within identity infrastructure gives a command execution flaw unusual significance because the primary domain controller emulator performs sensitive directory functions. SYSTEM-level execution on that host could create opportunities for serious administrative compromise, depending on surrounding controls and attacker privileges.
Tenable’s remediation instructions include an additional step beyond installing the software update. For existing installations, the vendor says administrators must run the Register-TenableIOA.ps1 script with its uninstall parameter and then reinstall the listener after upgrading. The company explicitly identifies this procedure as necessary to fully resolve the issue.
That requirement is operationally important. A release management record showing the new SaaS version does not by itself demonstrate that the older listener component has been replaced. Administrators therefore need to verify both the deployed application version and the local component’s installation state.
The vendor credits Takumi Ito with identifying the vulnerability. Its disclosure timeline states that the report arrived on 9 September, was validated on 24 September, and culminated in the October release. France’s CERT-FR subsequently listed the issue in advisory CERTFR-2026-AVI-1284 on 9 October, highlighting the need for component reinstallation.
The issue also illustrates a broader challenge with hybrid security products. A cloud-managed service may deploy or depend on local software that retains privileges inside a customer’s identity environment. Vulnerability management must therefore account for both the remote service version and the on-premises footprint that performs privileged work.
There is no verified evidence in the referenced vendor advisory of attacks exploiting CVE-2026-106126. The immediate priority is ensuring the full vendor remediation process has been completed, especially where responsibility for the cloud subscription and Windows domain components sits with different administrative teams.
An update can change the vulnerable software version while leaving an older deployed component active elsewhere in the environment. Tenable’s separate listener instruction is therefore a meaningful part of its remediation, rather than a routine note. A central console showing the new release number would not, on its own, establish that each installed component has been replaced correctly. Organisations need to distinguish deployment state from the availability of the vendor fix.
The identity-management context increases the stakes of the vulnerability class, but it does not justify assuming that every deployment has been compromised. Identity Exposure is designed to examine identity-related security conditions; that function makes permissions and placement important to exposure analysis. The reported remote-code consequence is tied to the advisory’s defined conditions, and affected version ranges must be checked against Tenable’s product bulletin rather than inferred from the software category.
