This vulnerability is a command injection flaw in the Active Directory Events Listener component of Tenable Identity Exposure (SaaS). An authenticated user with low privileges can inject and execute arbitrary operating‑system commands with SYSTEM rights on the PDCe, effectively granting remote code execution to the attacker. The flaw is classified as CWE-78.

Affected deployments are Tenable’s Identity Exposure SaaS offering, specifically the Active Directory Events Listener. No specific version numbers are supplied by the CNA, so all releases prior to the documented fix are potentially impacted.

The CVSS base score of 9.4 indicates critical severity. With an EPSS score of 2%, the exploit likelihood is low but non‑zero, suggesting that while the overall probability of exploitation is modest, it is not negligible. The flaw allows execution with SYSTEM privileges, reducing the barrier, so attackers with low‑privilege authenticated accounts can threaten the system. The vulnerability is not listed in the CISA KEV catalog as of the latest data.