Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

Microsoft SQL Server Multiple Vulnerabilities (April 2026)

The version of Tenable Identity Exposure running on the remote host is prior to 3.93.5. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-16:

  - Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose     sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user     accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with     Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and     serve sensitive data to unauthenticated users even after authentication is applied. (CVE-2026-13007)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows     an authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer     overflow on 32 bit platforms. A heap buffer overflow may lead to a crash or possibly an attacker     controlled code execution or other undefined behavior. (CVE-2026-31789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerabilities:

  - A privilege escalation vulnerability     (CVE-2026-32167, CVE-2026-32176)

  - A remote code execution vulnerability     (CVE-2026-33120)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
322483	Tenable Identity Exposure < 3.93.5 Multiple Vulnerabilities (TNS-2026-16)	Nessus	Misc.	high
307037	Security Updates for Microsoft SQL Server (April 2026)	Nessus	Misc.	high
307036	Security Updates for Microsoft SQL Server (April 2026)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2026-32176

high

Tenable Plugins

Coming Soon

high

high

high