EN PT-BR
← Voltar ao feed
high

CERT-FR advisory: multiple vulnerabilities in Tenable Network Monitor before 6.6.0 allow RCE, DoS and SSRF

1 fonte(s) · 1 atualização(ões) · publicado 26/10/2026 21:00 · coletado há 3 dias

CERT-FR published advisory CERTFR-2026-AVI-1390 on 27 October 2026 covering multiple vulnerabilities in Tenable Network Monitor versions prior to 6.6.0. The flaws allow remote arbitrary code execution, remote denial of service, server-side request forgery (SSRF), security policy bypass and compromise of data confidentiality and integrity. The advisory is based on Tenable security bulletin tns-2026-32 of 26 October 2026 and references roughly 90 CVE identifiers, largely stemming from bundled third-party components. No active exploitation, CVSS scores or IOCs are mentioned.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1390 covers about 90 CVEs in Tenable Network Monitor versions before 6.6.0. The listed impacts are remote arbitrary code execution, remote denial of service, SSRF, security policy bypass, and loss of data confidentiality and integrity. The advisory does not map impacts to individual CVEs, give CVSS scores, or say what an attacker needs (network reach, authentication, configuration). The fix is version 6.6.0 or later, per Tenable bulletin tns-2026-32.

Como funciona

The articles do not describe how any of these flaws work. They give no per-CVE detail on which input reaches which component or at what step it fails. All that is known is the set of impact classes (remote code execution, denial of service, SSRF, policy bypass, data exposure or tampering). The process cannot be reconstructed from this material.

Por que é vulnerável

The articles do not give root causes. The story says the long CVE list largely comes from bundled third-party components, which suggests the product shipped dependencies with known flaws, but the advisory itself does not detail this. The fix is the update to 6.6.0, and what it changes in code is not described.

Como foi descoberta

CERT-FR published the advisory on 27 October 2026, based on Tenable security bulletin tns-2026-32 of 26 October 2026. The articles do not say who found the flaws or how they were reported. They mention no active exploitation, no IOCs and no earlier reports.

Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 13:19.

Detalhes técnicos

  • Affected: Tenable Network Monitor versions earlier than 6.6.0.
  • Impacts listed: remote code execution, remote denial of service, SSRF, security policy bypass, loss of data confidentiality and integrity.
  • No per-CVE mapping of component or impact is provided in the advisory.

Remediação

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 26/10/2026 21:00 · coletado 29/10 13:01 primeiro registro

    CERT-FR advisory: multiple vulnerabilities in Tenable Network Monitor before 6.6.0 allow RCE, DoS and SSRF

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1390 on 27 October 2026 covering multiple vulnerabilities in Tenable Network Monitor versions prior to 6.6.0. The flaws allow remote arbitrary code execution, remote denial of service, server-side request forgery (SSRF), security policy bypass and compromise of data confidentiality and integrity. The advisory is based on Tenable security bulletin tns-2026-32 of 26 October 2026 and references roughly 90 CVE identifiers, largely stemming from bundled third-party components. No active exploitation, CVSS scores or IOCs are mentioned.

    Technical Details

    • Affected: Tenable Network Monitor versions earlier than 6.6.0.
    • Impacts listed: remote code execution, remote denial of service, SSRF, security policy bypass, loss of data confidentiality and integrity.
    • No per-CVE mapping of component or impact is provided in the advisory.

    Remediation