Media room

The near-closure of the Common Vulnerabilities and Exposures (CVE) program sparked concerns from the cybersecurity industry about its operation. Tenable CSO Bob Huber tells The Wall Street Journal that a public-private partnership is likely needed to spread responsibility, enhance the program and benefit the security industry, as well as national security.

Senior staff research engineer Satnam Narang shares insights on the curiously empty folder, labeled "inetpub," Microsoft added in the latest Windows 11 update. 

Interview with Liat Hayun discussing how cloud apps and AI tools create potentially harmful gaps in a company’s security infrastructure.

Steve Vintz, Tenable Co-CEO and CFO, was interviewed on CNBC Worldwide Exchange about Tenable’s most recent earnings results, his outlook for cyber spending in 2025 and how the acquisition of Vulcan Cyber will accelerate Tenable’s dominance in the growing exposure management market. Vintz also comments on how public sector spending may be impacted by DOGE and potential trade wars. 
 

Ninety-one percent of almost 30,000 internet-exposed Microsoft Exchange Server instances impacted by the ProxyLogon flaw leveraged by Chinese state-backed threat operation Salt Typhoon continue to be vulnerable to attacks involving the bug, tracked as CVE-2021-26855, nearly four years after it was patched according to Tenable Research. 

SonicWall released a hotfix for a critical pre-authentication remote code execution vulnerability in Secure Mobile Access 1000 products amidst reports of zero-day exploitation.
 

While information is currently limited, Scott Caveza, staff research engineer at Tenable, told Informa TechTarget that SonicWall's security advisory implies that the vulnerability was potentially exploited in the wild. Tenable cannot confirm the activity, but it is monitoring the situation for further developments, he added.

"Microsoft's Threat Intelligence Center reported the issue to SonicWall, which suggests there have been observations of exploitation," Caveza said in an email. "Despite the uncertainty around exploitation, threat actors have targeted SonicWall devices in the past and several SonicWall vulnerabilities have been featured on the Known Exploited Vulnerabilities (KEV) catalog from the U.S. Cybersecurity & Infrastructure Security Agency (CISA). Patching of impacted SonicWall devices should take priority to ensure this threat is mitigated as soon as possible."