Tenable Identity Exposure AD Listener Cmd Injection (CVE2026106126)
CVE-2026-106126 Published on October 8, 2026

Command Injection
A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.

NVD

Vulnerability Analysis

CVE-2026-106126 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Exploitation:
NONE
Automatable:
NO
Technical Impact:
TOTAL
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a Shell injection Vulnerability?

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CVE-2026-106126 has been classified to as a Shell injection vulnerability or weakness.


Affected Versions

Tenable, Inc. Tenable Identity Exposure (SaaS):