Tenable Identity Exposure Updates Fix Three Vulnerabilities
Tech GuruQuick Answer
Tenable TNS-2026-34 fixes three Identity Exposure vulnerabilities, including command execution as SYSTEM by a low-privileged authenticated user. Inventory the deployed stream, update to 3.93.6 or 3.77.18, validate identity monitoring and PDCe operations, review access and logs where warranted, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Identity Exposure servers, PDCe roles, exact release streams, authenticated users, GraphQL exposure, local log access, integrations, owners, backups, and maintenance windows. Match each deployment to Tenable's supported current or long-term stream; do not infer command execution or key disclosure merely because an older release is present. Install Tenable Identity Exposure 3.93.6 or 3.77.18 through the supported update channel and restrict administrative and host access while rollout is pending. Confirm the running version, test PDCe, directory and alert workflows, review low-privileged access and relevant host logs where warranted, rotate a linking key only when exposure evidence or policy requires it, and retain records.
Last verified: 2026-10-30 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Tenable Identity Exposure |
|---|---|
| Advisory | TNS-2026-34 |
| CVEs | CVE-2026-119314, CVE-2026-119315, CVE-2026-119316 |
| Authoritative release date | 2026-10-30 04:00:00 UTC |
| Authority revision date | 2026-10-30 13:27:07 UTC |
| Affected versions | Tenable Identity Exposure releases before 3.93.6 on the current stream and before 3.77.18 on the supported long-term stream. |
| Fixed version | Tenable Identity Exposure 3.93.6 or 3.77.18, according to the deployed support stream |
| CVSS base score | 9.9 / 4.3 / 4.1 (CVSS v3); 9.4 / 5.3 / 5.6 (CVSS v4) |
| CVSS severity | Medium to Critical |
| Exploitation status | Tenable does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Tenable fixed authenticated command injection on the PDCe, a GraphQL denial of service, and linking-key disclosure through a local error log.
What To Validate Now
- Inventory. Inventory Identity Exposure servers, PDCe roles, exact release streams, authenticated users, GraphQL exposure, local log access, integrations, owners, backups, and maintenance windows.
- Establish applicability. Match each deployment to Tenable's supported current or long-term stream; do not infer command execution or key disclosure merely because an older release is present.
- Remediate. Install Tenable Identity Exposure 3.93.6 or 3.77.18 through the supported update channel and restrict administrative and host access while rollout is pending.
- Validate. Confirm the running version, test PDCe, directory and alert workflows, review low-privileged access and relevant host logs where warranted, rotate a linking key only when exposure evidence or policy requires it, and retain records.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Identity-platform changes can affect directory collection and alerting. Preserve evidence before cleanup, protect secrets in tickets, and follow the correct supported release stream.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
