EUVD-2026-111267
GHSA-87pr-wf64-gvc5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Tanium Server account
-
ExploitSend request over network
-
ExecutionTrigger information disclosure
-
ImpactRead limited sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Error message sanitization
MITRE ATT&CK
1 technique across 1 tactic: Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account on the Tanium Server, as reflected by PR:L in the CVSS vector; it is network-reachable (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). No special non-default feature, protocol, or configuration mode is named in the available description, and the specific action that causes the disclosure is not described in the sources. Limiting factors: the attacker must first possess valid low-privilege credentials, the impact is confined to limited confidentiality disclosure (C:L) with no integrity or availability effect, and affected deployments are those running Tanium Server below the fixed versions 7.7.3.8351, 7.8.4.1399, or 7.8.2.1263; upgrading to those versions is the vendor-provided remediation. |
| Impact | This is a moderate-severity, lower-priority issue rather than an emergency. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - network-reachable and low-complexity, but requiring low-level privileges (PR:L, i.e. an authenticated account) and yielding only limited confidentiality impact with no integrity or availability impact. The CWE-209 classification points to information exposure, consistent with the 'information disclosure' description, but the specific trigger is not described in the available sources. The vuln.today decision label is 'this_month', which aligns with a medium-impact, authenticated, limited-disclosure flaw rather than act_now/emergency. No EPSS probability, CISA KEV listing, SSVC decision breakdown, or POC/exploit reference is present in the input, so there is no signal of active exploitation or public exploit code - consistent with a vendor-reported (Tanium self-reported) issue patched proactively. There are no conflicting signals here: every available indicator points to a bounded, authenticated information-disclosure bug of medium priority. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authenticated account on the Tanium Server interacts with it over the network and obtains limited sensitive information they should not be able to see. The exact interaction that triggers the disclosure is not described in the available sources. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Information disclosure in Tanium Server lets an authenticated low-privilege user expose limited sensitive data over the network, with no integrity or availability impact. The issue affects deployments running versions below 7.7.3.8351, 7.8.4.1399, and 7.8.2.1263, and Tanium has released fixed builds for each branch. Rated 4.3 with an AC:L/PR:L vector, it is a moderate-severity, lower-priority item - no public exploit identified at time of analysis and no CISA KEV listing.
RemediationAI
Vendor-released patch: upgrade Tanium Server to 7.7.3.8351 on the 7.7.3 branch, 7.8.4.1399 on the 7.8.4 branch, or 7.8.2.1263 on the 7.8.2 branch - matching the build number to the branch you currently run - per advisory TAN-2026-062 at https://security.tanium.com/TAN-2026-062. Because exploitation requires a valid low-privilege account (PR:L), the exposure window is bounded by credential hygiene, but no workaround or alternative mitigation is documented in the available sources, so upgrading is the only vendor-provided fix identified at time of analysis; scheduling can follow a normal monthly patch cadence consistent with the moderate severity and limited confidentiality-only impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-209, Generation of Error Message Containing Sensitive Information, so the underlying weakness is in how Tanium Server constructs and returns error or diagnostic output rather than in cryptographic or memory-safety handling. Per the CPE identifier cpe:2.3:a:tanium:tanium_server, the affected component is the Tanium Server itself, the central management and aggregation tier of the Tanium endpoint platform, which handles client communications, module data, and API requests. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates a network-reachable path with low attack complexity and no user interaction, gated on the attacker holding a valid low-privilege account (PR:L), with scope unchanged and only a limited confidentiality impact. The specific request, endpoint, or error condition that produces the disclosure is not described in the available sources, so the precise trigger remains unconfirmed; no non-default feature or configuration mode is named as a prerequisite beyond running an affected build.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable server requiring an authenticated low-privilege account (PR:L) and no user interaction; impact is limited confidentiality disclosure only (C:L, I:N, A:N).
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an information disclosure vulnerability in Tanium Server.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB