Exploit
Critical Command Injection Vulnerability in Tenable Identity Exposure SaaS (CVE-2026-106126, CVSS 9.9)
October 9, 2026
Cybersecurity
Exploit
Key Facts
Signal Type
Exploit
Industry
Cybersecurity
Companies
Tenable, HPE, Cisco
Date
October 9, 2026
Tenable disclosed CVE-2026-106126, a critical command injection vulnerability in the Tenable Identity Exposure (TIE) SaaS platform. The flaw, rated 9.9 on the CVSS scale, resides in the Active Directory Events Listener and allows authenticated, low-privileged attackers to execute arbitrary commands with SYSTEM-level privileges on the Primary Domain Controller Emulator (PDCe).
Tenable released TIE SaaS version 3.126.0 on October 8, 2026 to patch the vulnerability. As of the advisory, there is no evidence of active exploitation or public exploit code.
Organizations using affected versions of the Tenable Identity Exposure SaaS platform are at risk. The vulnerability is especially dangerous for tenants where the TIE service collects security event logs from domain controllers, as a successful exploit could compromise the entire Active Directory domain.
This incident also reflects a broader trend of identity infrastructure components being targeted, similar to recent vulnerabilities in HPE ClearPass and Cisco products.
The high severity and SYSTEM-level impact of this vulnerability create urgent demand for patching and assessment services among Tenable Identity Exposure customers.
Sales teams should monitor for proof-of-concept exploits or active exploitation reports in the coming weeks. Tenable customers who have not upgraded to v3.126.0 are prime prospects for urgent patch management and incident response conversations.
Also watch for follow-up advisories from Tenable or security research communities that may expand the scope of affected components or provide additional remediation guidance.
Source:
ThreatCluster Threat FeedGet cybersecurity signals in your CRM
Data breaches, ransomware events, funding rounds, and M&A across security vendors and targets.
