Tenable has fixed a critical command injection in the Active Directory Events Listener of Tenable Identity Exposure (SaaS), tracked as CVE-2026-106126. An authenticated, low-privileged attacker could run arbitrary commands as SYSTEM on the PDC emulator, which means the tool watching your AD could be used as a way into it.
What happened
Tenable published advisory TNS-2026-27 on October 8, 2026, alongside the release of Tenable Identity Exposure (TIE) SaaS 3.126.0. According to the advisory:
- Vulnerability: OS command injection (CWE-78) in the Active Directory Events Listener.
- Impact: an authenticated, low-privileged attacker can execute arbitrary commands as SYSTEM on the PDCe.
- Scores: Tenable rates it Critical, with a CVSS v3 base score of 9.9 (temporal 8.9) and a CVSS v4 base score of 9.4. The v3 vector is
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C. - Affected: Tenable Identity Exposure (SaaS) 3.125.0 and earlier.
- Fixed: TIE SaaS 3.126.0, available from the Tenable Downloads Portal.
- Credit: Takumi Ito. Tenable received the report on September 9 and confirmed it on September 24.
The important detail is in the solution section. Upgrading alone does not close the issue for existing deployments:
IMPORTANT: To fully resolve this issue, existing installations must run Register-TenableIOA.ps1 -Uninstall and reinstall the listener after upgrading.
The advisory does not report in-the-wild exploitation. Forkast, reporting on the advisory, said there was no evidence of public exploit code or in-the-wild exploitation at publication, and described the listener as a component deployed on domain controllers that collects security event logs and forwards them to the Tenable SaaS platform, using Register-TenableIOA.ps1 to deploy a WMI Active Script Consumer.
Why it matters
Identity threat detection and AD security monitoring tools need deep access to do their job. Even when the console is SaaS, the collection piece lives on your domain controllers and runs with the highest privileges available there. This bug is a reminder that those components are part of your Tier 0 attack surface, not just a view of it. Code execution as SYSTEM on the PDC emulator is effectively control of the domain: credential material, Group Policy, and every trust that hangs off AD.
The precondition is an authenticated, low-privileged attacker, which is a low bar. Phished user accounts and stolen session credentials are common, so the realistic path is an ordinary foothold turned into domain compromise through a security tool.
The post-upgrade step is where teams are likely to slip. SaaS customers often assume the vendor's release fixes everything; here, Tenable says the listener has to be removed and reinstalled before the issue is resolved.
What to check in your environment
- Confirm your Tenable Identity Exposure version. Anything at 3.125.0 or earlier is affected; the fix is 3.126.0.
- Find every domain controller where the AD Events Listener was deployed, starting with the PDC emulator in each domain where TIE is collecting events. Check change records from the original deployment so nothing is missed.
- After upgrading, run
Register-TenableIOA.ps1 -Uninstalland reinstall the listener, exactly as the advisory instructs. Treat this as a Tier 0 change with a named owner, and record when it was done per domain. - Verify event collection resumes in the TIE console after the reinstall, so the fix does not leave a monitoring gap on your most sensitive systems.
- Review the PDCe for unexpected activity while the vulnerable version was in place: new processes spawned from the listener's context, unfamiliar scheduled tasks or services, and unexpected changes to privileged groups or GPOs.
- Revisit who can authenticate to the systems that feed the listener. The bug needs only low privileges, so reducing stale and over-broad accounts shrinks the pool of footholds an attacker could use.
- Inventory other agents on your DCs (EDR, ITDR, backup, monitoring) and confirm each has an owner, a patch process and a vendor advisory subscription. Each one runs with privileges an attacker would want.