CVE-2026-4433 PUBLISHED

Assigner: tenable
Reserved: 19.03.2026 Published: 24.03.2026 Updated: 25.03.2026

An SSH misconfigurations exists in Tenable OT that led to the potential exfiltration of socket, port, and service information via the ostunnel user and GatewayPorts. This could be used to potentially glean information about the underlying system and give an attacker information that could be used to attempt to compromise the host.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CVSS Score: 1.9

Product Status

Vendor Tenable, Inc.
Product Tenable Operation Technology
Versions Default: unaffected
  • affected from 3.18.58 to 4.2.40 (incl.)

Solutions

Tenable has released Tenable OT Security and Tenable OT Security Enterprise Manager ISOs that contains the fix for new installations of the product. The installation files can be obtained from the Tenable Downloads Portal (https://www.tenable.com/downloads/tenable-appliance).

Tenable has released the patch to address this issue within the currently deployed products.

References

Problem Types

  • CWE-16: Configuration CWE