Tenable Identity Exposure < 3.77.18 (LTS) / 3.93.6 Multiple Vulnerabilities (TNS-2026-34)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(374266);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/02");

  script_cve_id("CVE-2026-119314", "CVE-2026-119315", "CVE-2026-119316");

  script_name(english:"Tenable Identity Exposure < 3.77.18 (LTS) / 3.93.6 Multiple Vulnerabilities (TNS-2026-34)");

  script_set_attribute(attribute:"synopsis", value:
"An identity security and threat detection platform running on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Tenable Identity Exposure running on the remote host is prior to 3.77.18 (LTS), or 3.78.x prior to
3.93.6. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-34:

  - A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure allows
    an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.
    (CVE-2026-119314)

  - A denial-of-service vulnerability exists in the Tenable Identity Exposure GraphQL API. An authenticated,
    low-privileged user can submit specially crafted queries that consume excessive server resources,
    potentially degrading or denying service to legitimate users. (CVE-2026-119315)

  - An information disclosure vulnerability exists in the Tenable Identity Exposure Windows Secure Relay. A failed
    Secure Relay installation writes the linking key to the local error log, where a user with access to the host
    could read it. (CVE-2026-119316)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://docs.tenable.com/release-notes/Content/identity-exposure/onprem/2026.htm
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fbb9c5dd");
  script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/tns-2026-34");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Tenable Identity Exposure version 3.77.18 (LTS), 3.93.6, or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-119314");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(78, 532, 770);
  script_set_attribute(attribute:"vendor_severity", value:"Critical");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/30");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tenable:tenable_ad");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tenable:tenable_identity_exposure");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ad_win_installed.nbin", "tenable_ad_web_detect.nbin");
  script_require_keys("installed_sw/Tenable.ad");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Tenable.ad', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '3.77.18', 'fixed_display': '3.77.18 (LTS) / 3.93.6'},
        {'min_version': '3.78.0', 'fixed_version': '3.93.6'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);