# CERT-FR flags dozens of Tenable Network Monitor flaws

Published: 2026-10-27 · Severity: elevated · Sectors: Technology
Canonical: https://vorant.io/reports/f868fa27-7f20-5c9a-8b7e-2da6a7d62ac6/cert-fr-flags-dozens-of-tenable-network-monitor-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR warns of over 90 vulnerabilities in Tenable Network Monitor before 6.6.0, including remote code execution, DoS, SSRF and data exposure risks.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1390

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR has published an advisory covering a large batch of vulnerabilities affecting Tenable Network Monitor versions prior to 6.6.0. The flaws, documented in Tenable's own security bulletin tns-2026-32 (26 October 2026), span a wide range of impact categories including remote arbitrary code execution, remote denial of service, loss of data confidentiality and integrity, security policy bypass, and server-side request forgery (SSRF). Given the sheer number of CVEs referenced (over 90), these likely stem from bundled third-party components and libraries within the product rather than a single root cause.

No detail is provided on exploitation status, proof-of-concept availability, or specific attack vectors for any individual CVE; the advisory is a standard vulnerability notification directing readers to the vendor bulletin for patches. Defenders running Tenable Network Monitor should prioritize upgrading to version 6.6.0 or later and consult the vendor bulletin for any available workarounds or configuration mitigations for the highest-impact issues (particularly those enabling remote code execution or SSRF).

## Mentioned in this report

- Vulnerabilities: CVE-2026-0989, CVE-2026-0990, CVE-2026-0992, CVE-2026-102633, CVE-2026-11352, CVE-2026-11564, CVE-2026-11586, CVE-2026-11979, CVE-2026-14456, CVE-2026-14457, CVE-2026-1757, CVE-2026-18798, CVE-2026-1965, CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-35189, CVE-2026-35191, CVE-2026-3783, CVE-2026-3784, CVE-2026-3805, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42772, CVE-2026-45186, CVE-2026-4873, CVE-2026-50219, CVE-2026-54872, CVE-2026-54873, CVE-2026-54874, CVE-2026-54875, CVE-2026-5545, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403, CVE-2026-56404, CVE-2026-56405, CVE-2026-56406

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1390

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f868fa27-7f20-5c9a-8b7e-2da6a7d62ac6/cert-fr-flags-dozens-of-tenable-network-monitor-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup