On December 5th, 2026, Tenable will update the IP addresses that your internal Tenable Nessus scanners and Tenable Agents connect to in the Tenable FedRAMP Moderate environment. This is a planned infrastructure update, and we are letting you know well in advance so you have time to prepare.

For most customers, this is a short firewall or proxy allowlist update. If you allow sensor traffic by hostname (*.fedcloud.tenable.com), you likely do not need to do anything. Your scans, data, sensor configurations and day-to-day use of Tenable are not changing.

Who needs to act

You need to act only if your firewalls, proxies or egress rules allow Tenable sensor traffic by specific IP address.

Action needed:

• Tenable FedRAMP Moderate customers whose internal Nessus scanners or Tenable Agents are allowlisted to Tenable by IP address.

No action needed:

• Customers who allowlist by hostname, using *.fedcloud.tenable.com (Tenable's recommended approach) or sensor.fedcloud.tenable.com.
•  Customers with no outbound IP restrictions on sensor traffic.
• Cloud-based network scans run from Tenable-managed cloud scanners. Those IP ranges (3.32.43.0/27, 3.31.100.0/24 and 2600:1f12:98d:c900::/56) are not changing.

Not sure how your network is configured? Forward this notice to your network or firewall team; the steps below are all they need.

What to do and when

Add the new IP addresses now, and remove the old ones only after December 5th, 2026. Keeping both sets in place during the transition ensures uninterrupted communication between your sensors and Tenable.

1. Now, before December 5th, 2026: add the four new IP addresses below to your allowlist, alongside your existing entries.
2. On December 5th, 2026: Tenable moves sensor traffic to the new addresses. No action is needed from you that day.
3. After December 5th, 2026: remove the eight retired IP addresses below.
4. Confirm: in Tenable Vulnerability Management, go to Settings > Sensors and check that your scanners and agents show as online with a recent last-connect time.

IP addresses to add now

IP addresses to remove after December 5th, 2026

If your network does not use IPv6 for outbound traffic, the IPv4 entries are sufficient. Adding both is recommended so you are covered if that changes.

What is not changing

This is a network address update only. Everything else about how you use Tenable FedRAMP stays the same:

• Your data and its protections. Your data remains hosted and protected within Tenable's FedRAMP Moderate authorized environment, under the same security controls.
• The connection hostname. Sensors continue to connect to sensor.fedcloud.tenable.com. You do not need to relink, reconfigure or upgrade any scanner or agent.
• Your scans and results. Scan schedules, policies, credentials, historical results and dashboards are unaffected.
• Cloud scanner ranges. IP ranges used by Tenable-managed cloud scanners for cloud-based network scans are unchanged.
• Service availability. No planned downtime is associated with this change.

Frequently asked questions

• Why is Tenable making this change?
  • This update is part of Tenable's ongoing infrastructure maintenance to keep the FedRAMP platform resilient, performant and secure.
• Can I add the new IP addresses now?
  • Yes, and we recommend it. Adding them early has no effect on current traffic and removes any risk of interruption on December 5th, 2026.
• What happens if I don't update my allowlist in time?
  • Sensors allowlisted only by the retired IP addresses may temporarily be unable to reach Tenable, which can delay scan results and agent check-ins. Communication resumes once the new addresses are added. No sensor configuration or historical data is lost.
• Do I need to update, relink or restart my scanners or agents?
  • No. Sensors continue to use sensor.fedcloud.tenable.com and pick up the new addresses automatically.
• How can I confirm everything is working after the change?
  • Go to Settings > Sensors in Tenable Vulnerability Management and confirm each scanner and agent shows as online with a recent last-connect time.
• Can I automate allowlist updates?
  • Yes. Tenable publishes its IP ranges in machine-readable JSON. FedRAMP entries appear under the fedramp_prefixes and fedramp_ipv6_prefixes keys (see Resources below).
• Does this affect commercial (non-FedRAMP) Tenable customers?
  • No. This notice applies only to the Tenable FedRAMP Moderate environment.

Resources and support

• Cloud Sensors documentation, including the Tenable FedRAMP Moderate Cloud Sensors section
• Tenable IP ranges in JSON format, for automated allowlist management

If you have questions or would like help planning this update, please contact Tenable Support or your Customer Success Manager. We're happy to walk through the change with your team.

Thank you for trusting Tenable to help secure your organization. We appreciate your partnership and your attention to this update.