Denial of service in Tanium Server via file descriptor exhaustion (CVE-2026-9156)

A denial of service vulnerability exists in Tanium Server that allows an unauthenticated attacker with network access to craft messages that exhaust server file descriptors and memory. Successful exploitation could render the Tanium Server unavailable. Affected versions: - 2024H2 Release: Tanium Server prior to Update 25 (v7.6.4.2190) - 2025H1 Release: Tanium Server prior to Update 19 (v7.7.3.8274) - 2025H2 Release: Tanium Server prior to Update 9 (v7.8.2.1176) We recommend updating to: 2024H2 Release: Update 25 (Tanium Server v7.6.4.2190), 2025H1 Release: Update 19 (Tanium Server v7.7.3.8274), 2025H2 Release: Update 9 (Tanium Server v7.8.2.1176), 2026H1 Release: Update 0 (Tanium Server v7.8.4.1298). CVSS 7.5 · our assessment: this_week Reference: https://security.tanium.com/TAN-2026-013 Details: https://vuln.today/cve/CVE-2026-9156