Microsoft patched 83 CVEs in March including two zero-day vulnerabilities that were publicly disclosed, including CVE-2026-21262 and CVE-2026-26127.

March 2026 Microsoft Patch Tuesday | Tenable®

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

The version of Tenable Identity Exposure running on the remote host is prior to 3.93.5. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-16:

  - Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose     sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user     accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with     Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and     serve sensitive data to unauthenticated users even after authentication is applied. (CVE-2026-13007)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows     an authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer     overflow on 32 bit platforms. A heap buffer overflow may lead to a crash or possibly an attacker     controlled code execution or other undefined behavior. (CVE-2026-31789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.17. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-11:

  - A flaw in Node.js's Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write`     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted     access only to the current directory can escape the allowed path and read sensitive files. This breaks the     expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.
    This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25. (CVE-2025-55130)

  - Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
    (CVE-2026-21262)

  - Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate     privileges over a network. (CVE-2026-26115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.17. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-11:

  - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script     granted access only to the current directory can escape the allowed path and read sensitive files. This     breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential     system compromise. (CVE-2025-55130)

  - Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate     privileges over a network. (CVE-2026-26115)

  - Improper access control in Curl allows an authorized attacker to elevate privileges over a network.
    (CVE-2026-21262)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerabilities:

  - A privilege escalation vulnerability     (CVE-2026-21262, CVE-2026-26115, CVE-2026-26116)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
322483	Tenable Identity Exposure < 3.93.5 Multiple Vulnerabilities (TNS-2026-16)	Nessus	Misc.	Combined	high
310403	Tenable Identity Exposure < 3.77.17 Multiple Vulnerabilities (TNS-2026-11)	Nessus	Misc.	Combined	high
307436	Tenable Identity Exposure < 3.77.17 Multiple Vulnerabilities (TNS-2026-11)	Nessus	Misc.	Combined	high
301981	Security Updates for Microsoft SQL Server (March 2026)	Nessus	Windows : Microsoft Bulletins	Local	high
301980	Security Updates for Microsoft SQL Server (March 2026) (Remote)	Nessus	Misc.	Remote	high

Detections

Analytics

CVE-2026-21262

high

Tenable Plugins

high

high

high

high

high