Tanium Patch CVE-2026-108308

Exploitation requires an authenticated low-privilege account on the Tanium platform (CVSS PR:L) and network access to the Patch module; no user interaction is needed (UI:N). The specific vulnerable Patch feature, endpoint, or injectable parameter is not described in the available sources, so the exact input that triggers the SQL injection cannot be named from the evidence. The principal limiting factor is the authentication prerequisite - an attacker must first possess valid console credentials - which confines practical risk to insiders or attackers who have already obtained a foothold; impact is further limited to confidentiality (data read) with no stated integrity or availability effect. Affected deployments are those running Patch 3.24 before 3.24.306, Patch 3.28 before 3.28.325, or Patch 3.32 before 3.32.353.

This is a moderate-priority, authenticated SQL injection (CWE-89) in the Tanium Patch module, rated CVSS 6.5. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N describes network-reachable, low-complexity exploitation that requires low-level privileges (PR:L), so it is an authenticated issue rather than a remote-unauthenticated one - this materially lowers real-world risk since an attacker needs valid, if limited, console access first. Impact is scoped to confidentiality only (C:H/I:N/A:N), consistent with data exfiltration via injected queries rather than data tampering or outage. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with a serious-but-not-urgent posture. No EPSS score was provided, there is no CISA KEV listing, and no proof-of-concept or exploit reference appears in the input, so exploitation signals are absent rather than negative; the only exploitation evidence available is the CVSS access profile itself. There is no SSVC exploitation/automatable/technical-impact decision data supplied. Net: a genuine authenticated information-disclosure flaw in an enterprise tool, worth scheduled remediation, but not a drop-everything emergency on the signals provided. Note one internal tension to verify with the vendor: SQL injection commonly permits data modification, yet the supplied vector sets I:N - if write/integrity impact is actually possible this score would understate the risk.

An attacker who already holds a low-privileged authenticated account on the Tanium platform submits crafted input to a Patch feature that is concatenated into a backend SQL query, injecting their own SQL to read data they should not be able to access. Because the attack is network-based and low-complexity (AV:N/AC:L), it is straightforward to execute once minimal console access is obtained. No public exploit code or PoC reference is present in the available data.