When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.

The version of Tenable Identity Exposure running on the remote host is prior to 3.93.5. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-16:

  - Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose     sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user     accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with     Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and     serve sensitive data to unauthenticated users even after authentication is applied. (CVE-2026-13007)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows     an authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer     overflow on 32 bit platforms. A heap buffer overflow may lead to a crash or possibly an attacker     controlled code execution or other undefined behavior. (CVE-2026-31789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The version of curl installed on the remote host is 8.17.0 prior to 8.20.0. It is, therefore, affected by an OCSP stapling bypass vulnerability:

  - When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP     stapling, to verify that the server certificate is valid, it fails to detect OCSP problems and instead     wrongly consider the response as fine. This flaw only manifests when curl is built with an OpenSSL-based     backend while running on Apple operating systems with Apple SecTrust enabled. (CVE-2026-7009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
322483	Tenable Identity Exposure < 3.93.5 Multiple Vulnerabilities (TNS-2026-16)	Nessus	Misc.	high
318364	Photon OS 5.0: Curl PHSA-2026-5.0-0856	Nessus	PhotonOS Local Security Checks	medium
311424	Curl 8.17.0 < 8.20.0 OCSP Stapling Bypass	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-7009

medium

Tenable Plugins

high

medium

medium