A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.
To fully resolve this issue, existing installations must run Register-TenableIOA.ps1 -Uninstall and reinstall the listener after upgrading. Please see the full release notes for additional instructions. ( https://docs.tenable.com/identity-exposure.htm )