Tanium End-User CX CVE-2026-108304

Requires local access to a Tanium-managed endpoint running the affected End-User CX / End-User Notifications component or the Endpoint Configuration Toolset Solution, plus a low-privileged authenticated context (PR:L) on that host - this is not remotely exploitable (AV:L). The specific feature state, configuration, or link-handling path that triggers the CWE-59 flaw is not described in the available sources; the Tanium advisory (TAN-2026-058) should be consulted for the exact affected configurations. Limiting factors: attacker must already have a local foothold, which substantially narrows realistic exploitation to post-compromise privilege escalation or malicious insiders.

This is a credible but non-emergency local privilege escalation. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable flaw requiring an already-authenticated low-privileged account (PR:L), low attack complexity, no user interaction, and full compromise of confidentiality, integrity, and availability on the local host with an unchanged scope. CWE-59 (improper link resolution / link following) is consistent with a classic local link-abuse path to higher privileges. The decision signals point to real but moderate urgency: vuln.today assigns a 'this_week' priority (not act_now/emergency), the CVE is NOT in CISA KEV, and no EPSS score was supplied - so no evidence of widespread automated exploitation. No POC or exploit reference is present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The local-only attack vector is the single biggest risk-limiting factor: an attacker must first obtain code execution or a foothold on the endpoint. Net: a genuine fix-this-week patch item for Tanium-managed estates, not a drop-everything internet-facing crisis. Note the AC:L rating is the vendor's; for CWE-59 link-following bugs AC:H is often warranted, but the description does not state the trigger, so this cannot be confirmed.

A low-privileged local user (or malware already running in a standard user context) on a Tanium-managed endpoint abuses the End-User Notifications / End-User CX component's handling of a filesystem link (CWE-59) to cause a privileged process to act on an attacker-controlled path, escalating to SYSTEM/root-level control of the host. No user interaction is required and attack complexity is rated low. No public exploit code or POC reference is present in the supplied data.