Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.17. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-11:

  - A flaw in Node.js's Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write`     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted     access only to the current directory can escape the allowed path and read sensitive files. This breaks the     expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.
    This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25. (CVE-2025-55130)

  - Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
    (CVE-2026-21262)

  - Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate     privileges over a network. (CVE-2026-26115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.17. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-11:

  - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script     granted access only to the current directory can escape the allowed path and read sensitive files. This     breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential     system compromise. (CVE-2025-55130)

  - Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate     privileges over a network. (CVE-2026-26115)

  - Improper access control in Curl allows an authorized attacker to elevate privileges over a network.
    (CVE-2026-21262)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerabilities:

  - A privilege escalation vulnerability     (CVE-2026-21262, CVE-2026-26115, CVE-2026-26116)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
310403	Tenable Identity Exposure < 3.77.17 Multiple Vulnerabilities (TNS-2026-11)	Nessus	Misc.	Combined	high
307436	Tenable Identity Exposure < 3.77.17 Multiple Vulnerabilities (TNS-2026-11)	Nessus	Misc.	Combined	high
301981	Security Updates for Microsoft SQL Server (March 2026)	Nessus	Windows : Microsoft Bulletins	Local	high
301980	Security Updates for Microsoft SQL Server (March 2026) (Remote)	Nessus	Misc.	Remote	high

Detections

Analytics

CVE-2026-26115

high

Tenable Plugins

high

high

high

high