CVE-2026-106126: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in Tenable, Inc. Tenable Identity Exposure (SaaS)

This vulnerability (CVE-2026-106126) involves improper neutralization of special elements used in OS commands (CWE-78) within the Active Directory Events Listener of Tenable Identity Exposure (SaaS). An authenticated attacker with low privileges can exploit this flaw to execute arbitrary system commands as SYSTEM on the PDCe, potentially leading to full system compromise. The affected versions are >=0 and <3.126.0. The CVSS v3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated low-privileged attacker to execute arbitrary commands as SYSTEM on the Primary Domain Controller emulator, resulting in full system compromise. This can lead to complete loss of confidentiality, integrity, and availability of the affected system and potentially the broader network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a SaaS product but marked as not a cloud service in the input, remediation may require updating to a fixed version once available. Until then, restrict access to the Active Directory Events Listener component to trusted users only and monitor for suspicious activity.