EUVD-2026-111268
GHSA-jwp7-fjh9-prch
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Certificate Manager
-
DeliverySubmit crafted input to vulnerable function
-
ExploitTrigger command injection (CWE-77)
-
ExecutionExecute arbitrary code on host
-
ImpactCompromise confidentiality, integrity, and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Tanium Certificate Manager module specifically (not a default-reachable, unauthenticated internet service), and the supplied CVSS vector (PR:L) indicates the attacker must already hold low-level authenticated access to the Certificate Manager instance before triggering the flaw. The exact feature, input, or command path that is injected (CWE-77) is not described in the available sources. Limiting factors: required prior authentication (PR:L), the need for network reachability to the Certificate Manager service, and applicability only to affected branches below the fixed versions (1.17.417, 1.18.368, 1.22.119); no user interaction is required (UI:N). |
| Impact | This is a credible near-term priority rather than a theoretical high-CVSS issue, but several signals are thin. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring some level of authenticated privilege (PR:L), with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) on an unchanged scope. CWE-77 and the 'RCE/Command Injection' tags align with the 'unauthorized code execution' description. The vendor-assigned priority is 'this_week', and a patch is available, which together argue for prompt but not emergency remediation. However, EPSS is not provided, the CVE is not listed in CISA KEV, and no working exploit is referenced - so there is no evidence of active exploitation or widespread automated targeting at this time. The main caveat: the description is extremely sparse and does not explain the trigger or what privilege level 'unauthorized' maps to, so the PR:L assumption (authenticated low-privileged attacker) is carried from the supplied CVSS vector and should be confirmed with Tanium advisory TAN-2026-075. |
| Exploit ScenarioDerived | An attacker with low-level authenticated access to a Tanium Certificate Manager instance submits crafted input that the component passes into a command context (CWE-77), resulting in code execution on the host with the component's privileges. Because the vector is network-reachable with low complexity, exploitation does not require user interaction, but it does require prior authenticated access; the specific trigger is not described in the available sources. No public exploit or PoC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauthorized code on the affected module. Certificate Manager 1.17 before 1.17.417, 1.18 before 1.18.368, and 1.22 before 1.22.119 are affected; the vendor has released fixed builds and vuln.today assigns this_week priority. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: update Certificate Manager 1.17 to 1.17.417, 1.18 to 1.18.368, and 1.22 to 1.22.119 per Tanium advisory https://security.tanium.com/TAN-2026-075. The advisory and NVD entry are the cited remediation references. Until upgraded, reduce exposure by limiting network reachability to the Certificate Manager service and restricting authenticated access to authorized administrators, consistent with the assessed prerequisites (PR:L and network reachability).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tanium Certificate Manager is the affected Tanium module, identified by CPE cpe:2.3:a:tanium:certificate_manager:*:*:*:*:*:*:*:*. CWE-77 describes improper neutralization of special elements used in a command, placing this in the command-injection class; the supplied CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning network reachability, low complexity, low authenticated privileges, no user interaction, and high confidentiality, integrity and availability impact. The exact feature, input, or command path that is injected is not described in the available sources, and the assessment notes this is not a default-reachable, unauthenticated internet service; exploitation requires prior low-level authenticated access to the Certificate Manager instance. ENISA tracks it as EUVD-2026-111268.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable command injection requiring low-privileged authentication (PR:L) per the vendor vector, low complexity, no user interaction, and full host code execution giving C:H/I:H/A:H.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
2DescriptionCVE.org
Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.
Executive ViewAI
Tanium Certificate Manager, a critical component for managing digital certificates across the enterprise, has a high-severity command injection vulnerability that allows an authenticated user with low-level access to execute arbitrary code. This could lead to unauthorized access to sensitive certificate private keys, disruption of certificate lifecycle operations, and potential lateral movement within the Tanium environment. Security leadership should prioritize patching because this affects the integrity of the organization's PKI and could undermine trust in the Tanium platform.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance. [CVSS 7.8 HIGH]
Exploit-DB