External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.

The version of Tenable Identity Exposure running on the remote host is prior to 3.93.5. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-16:

  - Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose     sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user     accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with     Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and     serve sensitive data to unauthenticated users even after authentication is applied. (CVE-2026-13007)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows     an authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer     overflow on 32 bit platforms. A heap buffer overflow may lead to a crash or possibly an attacker     controlled code execution or other undefined behavior. (CVE-2026-31789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability:

  - External control of file name or path in SQL Server allows an authorized attacker to execute code over     a network. (CVE-2026-40370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
322483	Tenable Identity Exposure < 3.93.5 Multiple Vulnerabilities (TNS-2026-16)	Nessus	Misc.	Combined	high
314668	Security Updates for Microsoft SQL Server (May 2026)	Nessus	Windows : Microsoft Bulletins	Local	high
314667	Security Updates for Microsoft SQL Server (May 2026) (Remote)	Nessus	Misc.	Remote	high

Detections

Analytics

CVE-2026-40370

high

Tenable Plugins

high

high

high