Tanium End-User CX CVE-2026-108305

Exploitation requires the attacker to already have a local, low-privileged account or code execution on a host running the affected Tanium components - End-User CX (end-user-cx) or the Endpoint Configuration Toolset Solution - per AV:L and PR:L in the CVSS vector; it cannot be performed remotely or unauthenticated, and UI:N means no victim interaction is needed once local access is held. The weakness is link-following (CWE-59), so the realistic precondition is the ability to create or control a file-system link or path that a higher-privileged Tanium process will resolve, but the specific feature, path, or configuration that triggers the flaw is not described in the available sources. Limiting factors: the requirement for a pre-existing local foothold and for the vulnerable, pre-fix version to be installed (fixed in end-user-cx 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766, 1.24.590 and Endpoint Configuration Toolset Solution 1.51.60, 1.59.50, 1.71.25 per the branch list) substantially narrows the exposed population to already-compromised or multi-user endpoints.

This is a genuine but contained local-privilege-escalation risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a flaw reachable only by an attacker who already has a low-privileged foothold on the host running the Tanium End-User Notifications / end-user-cx and Endpoint Configuration Toolset components; it is not network-reachable and not pre-authentication. No EPSS score and no KEV listing were supplied, and the only references are the Tanium advisory (TAN-2026-061) and the NVD/EUVD entry, so there is no public exploit code and no evidence of in-the-wild use - consistent with no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', which aligns with the signal set: high local impact and an available vendor patch, but no confirmed exploitation and low automatability (the attacker must first obtain local access). The CWE-59 classification (improper link resolution / link-following) points to a symlink-style abuse, but the advisory text itself does not describe the trigger, so the exact mechanism is not described in the available sources. Net: treat as a prioritized patch-this-week item on Tanium-managed endpoints, especially multi-user or shared hosts, not as a critical externally-exploitable breach.

A local user with limited privileges on a workstation managed by Tanium abuses the End-User Notifications / Endpoint Configuration Toolset component (classified CWE-59, link following) to cause a privileged Tanium process to act on an attacker-controlled path, escalating to full compromise of the host. The exact trigger is not described in the available sources, and no public proof-of-concept or exploit code was provided. Exploitation requires prior local access, so there is no remote or unauthenticated path.