CVE-2026-106126

Executive Summary

CVE-2026-106126 is a command injection vulnerability (CWE-78) in the Active Directory Events Listener component of Tenable Identity Exposure, a SaaS-delivered Active Directory attack-surface and identity-risk monitoring platform. An authenticated, low-privileged attacker can inject and execute arbitrary operating-system commands with SYSTEM privileges on the Primary Domain Controller Emulator (PDCe) — the domain controller that holds the PDC Emulator FSMO role. With a CVSS v3.1 base score of 9.9 (Critical), a scope change (S:C) and full confidentiality, integrity, and availability impact, the flaw is effectively a domain-controller-takeover primitive reachable by any low-privileged domain account that can reach the listener service. No public proof-of-concept, exploit code, or Nuclei template is currently available, and no patch evidence exists from any tracked source.

Technical Analysis

Vulnerability Class

CVE-2026-106126 is a classic OS command injection (CWE-78, mapped to MITRE ATT&CK T1059 — Command and Scripting Interpreter). The weakness resides in the Active Directory Events Listener component of Tenable Identity Exposure, a SaaS product that ingests and analyzes Active Directory telemetry (event logs, replication data, directory-service events) to detect identity-related attack paths.

Command injection occurs when an application passes externally influenced input to an operating-system command interpreter (shell) without sufficient neutralization of shell metacharacters or argument delimiters. In the context of an AD events listener, the input vector is typically data derived from events the listener processes — event fields, directory attributes, replication metadata, or query parameters associated with the listener's ingestion or configuration channel. Whatever the exact ingress point, the security-relevant fact from the CNA description is unambiguous: an authenticated low-privileged actor can cause arbitrary commands to be executed by the listener host.

Attack Surface and Trust Boundary

The critical trust-boundary violation is that the listener runs with SYSTEM privileges on the PDCe. Input that should be treated as untrusted data is instead reaching a command interpreter. Because the listener is a SaaS-managed component, the affected host is inside the customer's on-premises Active Directory environment, while the listener binary and its logic are vendor-controlled and remotely maintained. This creates a hybrid trust model: the vendor ships and updates the agent/listener, but the blast radius lands on the customer's most sensitive domain controller.

The PDCe is the single most impactful target in an AD forest. It is the authoritative time source, the target of urgent replication, the default location for password-change propagation, and a frequent host for the domain's RID Master cooperation and account-lockout processing. Code execution as SYSTEM on the PDCe is functionally equivalent to domain compromise: the attacker can read/write the directory database (NTDS.dit), dump credential material, forge Kerberos tickets, establish persistence at the forest level, and disable or manipulate monitoring agents.

Code-Level Notes

The NVD description does not disclose the specific function, parameter, or endpoint through which the injection is reached. No vulnerable method name, API path, or argument is identified in the available data, and none is asserted here. Analysis is therefore confined to the vulnerability class: the listener fails to sanitize or properly parameterize input before invoking an OS command, and the resulting execution context is SYSTEM on the PDCe.

CVSS Subscore Reasoning

• AV:N — the listener is network-reachable; exploitation does not require adjacent or local access.
• AC:L — no special conditions or race windows are indicated.
• PR:L — the attacker must be authenticated but holds only low privileges.
• UI:N — no user interaction is required.
• S:C — the vulnerable component (the listener) and the impacted component (the PDCe/AD domain) are authority-separated, which is precisely why the scope is Changed.
• C:H/I:H/A:H — full read, write, and denial of service capability on the compromised PDCe, with downstream domain-wide consequences.

The combination of low privileges and a Changed scope is what drives the score to 9.9 and places the issue at the very top of critical severity.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the CNA description. No public proof-of-concept exists, and no specific implementation details are asserted.

1. Reconnaissance and target identification. An attacker who already holds a foothold in the customer's Active Directory environment — for example, any ordinary domain user account, an account obtained through phishing, or a service account — enumerates hosts to locate the PDCe and identifies the Active Directory Events Listener deployed by Tenable Identity Exposure. Because the listener communicates over the network to the SaaS backend, its presence is discoverable through service enumeration and through the outbound telemetry it emits.

2. Triggering the flaw class. The attacker interacts with the input surface of the events listener using an authenticated, low-privileged session. The command-injection condition is triggered when attacker-influenced data reaches the listener's command interpreter without neutralization of shell metacharacters or command separators. The precise input channel is not disclosed in the available data; at the class level, this is any listener input path that is concatenated into an OS command invocation.

3. Payload execution. By including shell metacharacters and command separators in the input, the attacker causes the listener process to spawn an additional command. Because the listener runs as SYSTEM on the PDCe, the injected command inherits SYSTEM integrity on the domain controller. Execution would typically establish a reverse shell, drop a beacon, or write a file to a known location for later retrieval. No specific payload, path, or interpreter invocation is asserted here because the description does not provide them.

4. Post-exploitation impact. With SYSTEM on the PDCe the attacker can: extract the Active Directory database and cached credentials; create or modify directory objects, including privileged accounts and AdminSDHolder-derived ACLs; forge Kerberos tickets (golden/silver ticket variants) given access to the KRBTGT-adjacent material obtained from the DC; manipulate replication; and tamper with or disable the Tenable listener itself and other security tooling. The result is a durable, domain-wide compromise that survives conventional remediation on member servers and workstations.

Caveat. No public exploit, exploit code, or Nuclei template exists for this CVE. The mechanics above describe the vulnerability class; the exact injection point and payload shape are not publicly documented.

Impact Assessment

Business Impact

Tenable Identity Exposure is designed to protect Active Directory — the authentication backbone of the vast majority of enterprises. A vulnerability that converts a low-privileged domain account into SYSTEM on the PDCe inverts the product's purpose: the security control becomes the initial-access and privilege-escalation vector. The blast radius is the entire AD forest and every resource that trusts it, including mail, file shares, SaaS SSO via federation, VPN, and backup systems.

Affected Systems

• Primary: Domain controllers holding the PDCe FSMO role in customer environments running the affected listener.
• Secondary: All domains and forests trusting the compromised domain; any system accepting Kerberos tickets from it.
• Platform category: SaaS-delivered agent/listener components maintained by the vendor but executed on customer-managed infrastructure.

Blast Radius and Severity

The Changed scope in the CVSS vector is the key indicator: compromise escapes the vulnerable listener and reaches the domain controller, a separate security authority. Full C/I/A on the PDCe implies complete loss of confidentiality and integrity of the directory, plus the ability to render authentication services unavailable. This is a worst-case severity profile short of a pre-authentication wormable RCE.

Exploitability and Threat Context

• EPSS: Not yet scored by FIRST.org. No EPSS value is asserted in this report.
• CISA KEV: Not listed.
• Public PoC / Exploit Code / Nuclei Template: None known.
• Patch confidence: 0/4 — unpatched, with no patch evidence from any tracked source.

Although no exploitation has been observed publicly, the low privileges required and the SYSTEM-on-PDCe outcome make this an attractive target for both ransomware operators (who conventionally seek DC-level control for mass deployment) and state-linked actors. Absence of a public PoC does not meaningfully reduce risk: command injection into a SYSTEM process is among the simplest classes to weaponize once the injection point is identified.

Detection Guidance

Detection strategy centers on observing anomalous child-process creation by the Identity Exposure listener on domain controllers, network egress from that listener to unexpected destinations, and the specific command-line artifacts typical of command injection (shell metacharacters, unexpected interpreters, encoded payloads). Because the vendor and file paths vary across deployments, the rules below use generalized, behavior-based matching and should be tuned to the customer's environment.

Sigma Rule

title: Suspicious Child Process Spawned by Tenable Identity Exposure AD Events Listener
id: 3f9c1a2e-7d4b-4e51-9a8c-1b2e5c7d6f90
status: experimental
description: Detects command interpreter or reconnaissance process creation by the Tenable Identity Exposure Active Directory Events listener on a domain controller, indicating potential command injection (CVE-2026-106126).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106126
author: valtersit.com
date: 2026-01-01
tags:
  - attack.execution
  - attack.t1059
  - cve.2026.106126
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\TenableIdentityExposure.exe'
      - '\TenableADListener.exe'
      - '\tenable_identity_exposure.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wmic.exe'
      - '\net.exe'
      - '\whoami.exe'
      - '\ntdsutil.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
  condition: selection_parent and selection_child
fields:
  - ParentImage
  - Image
  - CommandLine
  - User
level: critical
falsepositives:
  - Legitimate vendor maintenance scripts invoked by the listener during upgrades or diagnostics

YARA Rule

rule CVE_2026_106126_CommandInjection_Payload
{
    meta:
        description = "Detects common encoded/obfuscated command-injection payload markers that may be dropped or executed during CVE-2026-106126 exploitation on a PDCe."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106126"
        date = "2026-01-01"
        severity = "critical"
        tlp = "WHITE"

    strings:
        $s1 = "-enc " ascii nocase
        $s2 = "-EncodedCommand" ascii nocase
        $s3 = "IEX(" ascii nocase
        $s4 = "Invoke-Expression" ascii nocase
        $s5 = "FromBase64String" ascii nocase
        $s6 = "cmd.exe /c" ascii nocase
        $s7 = "cmd /c" ascii nocase
        $s8 = "powershell -" ascii nocase
        $s9 = "&&" ascii
        $s10 = "|" ascii
        $s11 = "ntdsutil" ascii nocase
        $s12 = "vssadmin" ascii nocase
        $s13 = "secretsdump" ascii nocase
        $s14 = "DownloadString" ascii nocase
        $s15 = "WebClient" ascii nocase

    condition:
        uint16(0) == 0x5A4D and 2 of ($s*)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-106126 Possible Tenable Identity Exposure AD Listener Command Injection - Shell Metacharacter in Listener Traffic"; flow:established,to_server; content:"|3b|"; content:"cmd"; nocase; content:"|7c|"; nocase; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-106126; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106126; metadata:service http, affected_product Tenable_Identity_Exposure; sid:2026106126; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name != null and
  process.parent.name : ("TenableIdentityExposure.exe", "TenableADListener.exe") and
  process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wmic.exe",
                  "certutil.exe", "mshta.exe", "rundll32.exe", "ntdsutil.exe",
                  "net.exe", "whoami.exe", "bitsadmin.exe")

Splunk SPL Query

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent=lower(ParentImage), child=lower(Image)
| where (like(parent,"%tenable%")) AND (child LIKE "%cmd.exe" OR child LIKE "%powershell.exe" OR child LIKE "%pwsh.exe" OR child LIKE "%wmic.exe" OR child LIKE "%certutil.exe" OR child LIKE "%ntdsutil.exe" OR child LIKE "%bitsadmin.exe" OR child LIKE "%mshta.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines by host, parent, child, User
| sort - count

Wazuh OSSEC Rule

<group name="windows,sysmon,tenable,cve_2026_106126,">
  <rule id="106126" level="14">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage" type="pcre2">(?i)tenable.*(listener|identityexposure)\.exe</field>
    <field name="win.eventdata.image" type="pcre2">(?i)(cmd|powershell|pwsh|wmic|certutil|ntdsutil|bitsadmin|mshta|rundll32)\.exe</field>
    <description>CVE-2026-106126: Suspicious child process spawned by Tenable Identity Exposure AD Events Listener on domain controller (possible SYSTEM command injection).</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>cve_2026_106126,command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. Vendor fix: N/A. Workarounds: N/A.

1. Immediate Mitigations

Because Tenable Identity Exposure is delivered as SaaS but the listener executes on the customer's PDCe, apply compensating controls on the customer side while awaiting vendor remediation:

• Constrain the listener's privilege. Where the deployment permits, evaluate whether the AD Events Listener service account can be moved off SYSTEM. Changing a per-component service identity is a significant configuration decision and may not be supported by the vendor; assess with Tenable before making changes. Lowering effective privilege materially reduces the impact of the injection even if the flaw remains.
• Restrict network reachability to the listener. Apply host-based firewalls on PDCe systems so only the SaaS backend endpoints and authorized management hosts can reach the listener's ingress paths. Reducing ingress reduces the injection surface.
• Limit low-privileged interactive access to DCs. Domain controllers should not be logon targets for ordinary users. Enforce "Deny log on locally" and "Deny access to this computer from the network" for unprivileged groups via GPO, and enforce tiered administration so that low-privileged accounts cannot initiate sessions that could be leveraged to reach the listener.
• Monitor and alert. Deploy the Sigma, EQL, SPL, Suricata, and Wazuh detections above to detect child-process creation from the listener and anomalous shell metacharacter traffic.
• Contain blast radius. Ensure adequate backups of the AD database and system state, verify KRBTGT rotation procedures, and confirm that Emergency/DR break-glass accounts are operational and not dependent on the PDCe listener path.

2. Patch / Upgrade Steps

• Contact Tenable support for the current remediation status of CVE-2026-106126. Because the product is SaaS, remediation is expected to occur on the vendor side; confirm whether a listener component update is required on-premises and how to obtain it.
• Subscribe to Tenable's security advisory channel and the Tenable Identity Exposure release notes for the fixed version. No fixed version is currently published; the specific AFFECTED_VERSION range cannot be confirmed from available data.
• After any vendor fix is applied, verify the listener version, re-run the detection rules to confirm legitimate behavior is not falsely flagged, and perform a threat hunt over the preceding 30–90 days for signs the flaw was used prior to patching.

3. Long-Term Hardening

• Least privilege for security agents. Audit every vendor agent and listener running on domain controllers. Any component that must run at SYSTEM should have a documented business need and a compensating detective control.
• Segmented tier-0 model. Treat domain controllers, identity infrastructure, and the agents that inspect them as tier-0 assets. Restrict both interactive and network logon, and require privileged access workstations for any administrative touch.
• Detect DC-level post-exploitation. Alert on ntdsutil, vssadmin, secretsdump, DCSync replication (DRSUAPI), and unusual Kerberos ticket activity regardless of source. These are the actions an attacker will take after reaching SYSTEM on a PDCe.