Tenable Identity Exposure patches 100+ flaws
Tenable has patched over 100 vulnerabilities in Identity Exposure versions prior to v3.93.5, including flaws enabling remote code execution, SQL injection, and data breaches.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2025-55315 (poc); no exploitation in the wild is recorded.
France's CERT-FR issued an advisory for multiple vulnerabilities discovered in Tenable Identity Exposure affecting all versions prior to v3.93.5. The security update addresses over 100 CVEs spanning a wide range of vulnerability classes including remote code execution, SQL injection, denial of service, security policy bypass, and confidentiality breaches. The sheer volume of patched flaws suggests either a comprehensive security audit or coordinated disclosure of accumulated issues.
Tenable Identity Exposure is an Active Directory security solution used to detect attack paths and privilege escalation risks in enterprise environments. Given its access to sensitive directory data and authentication infrastructure, these vulnerabilities could allow attackers to compromise identity management systems, potentially enabling lateral movement across enterprise networks. The advisory lists impacts including arbitrary code execution, SQL injection, and data integrity violations.
Tenable released security bulletin TNS-2026-16 on June 23, 2026, providing patches in version 3.93.5. Organizations running earlier versions should prioritize this update given the product's privileged access to directory infrastructure and the presence of remote code execution vulnerabilities.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0796
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs