Detections
Analytics
Tenable Identity Exposure < 3.77.16 Multiple Vulnerabilities (TNS-2026-03)
high Nessus Plugin ID 297848
Language:
Synopsis
An identity security and threat detection platform running on the remote host is affected by multiple vulnerabilities.Description
The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.16. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-03:- Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function, leading to a crash and Denial of Service for an application processing PKCS#12 files. (CVE-2025-69421)
- Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer, which can cause memory corruption leading to Denial of Service. (CVE-2025-69419)
- An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file, causing the application to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. (CVE-2026-22795)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Tenable Identity Exposure version 3.77.16 or later.See Also
Plugin Details
Severity: High
ID: 297848
File Name: tenable_identity_exposure_3_77_16.nasl
Version: 1.2
Type: combined
Family: Misc.
Published: 2/4/2026
Updated: 2/5/2026
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.0
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2025-69421
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:tenable:tenable_ad, cpe:/a:tenable:tenable_identity_exposure
Required KB Items: installed_sw/Tenable.ad
Exploit Ease: No known exploits are available
Patch Publication Date: 2/3/2026
Vulnerability Publication Date: 2/3/2026