Tanium Threat Response CVE-2026-116646

The attacker must possess valid low-privilege authentication to the Tanium Threat Response service, as indicated by PR:L in the CVSS vector; this is not a pre-authentication flaw. The description does not name the exact feature, protocol, API, or configuration that triggers the uncontrolled resource consumption, so the precise trigger is not described in the available sources. Limiting factors that reduce real-world risk: required authentication (even if low-privilege), impact confined to availability (A:L) with no confidentiality or integrity effect, and no public exploit to lower the barrier to abuse. Exposure is further bounded to environments running Tanium Threat Response reachable over the network by authenticated principals.

This is a low-to-moderate priority issue, not an emergency. The CVSS base score is 4.3 (Medium) and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L shows the only impact is a low hit to availability (A:L) with no confidentiality or integrity consequences - consistent with the CWE-770 uncontrolled resource consumption / denial-of-service classification. Exploitation is network-reachable and low-complexity but requires existing low-privilege authentication (PR:L), so it is not a pre-auth remote DoS. The vuln.today decision label is 'this_month', indicating a routine-patch cadence rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no public exploit were provided; the single reference is the Tanium vendor advisory (TAN-2026-097), not exploit code. There is no conflicting signal here - all sources point the same direction: a self-reported, vendor-disclosed, authenticated availability bug of limited scope. The main missing data are EPSS probability and any confirmed fixed-version string, which the advisory URL likely contains but is not reproduced in the provided input.

An attacker who already holds valid low-privilege credentials to the Tanium Threat Response service sends requests over the network that cause the component to consume excessive resources, degrading or interrupting its availability for legitimate users. The specific trigger is not described in the available sources, and no public proof-of-concept or exploit code was provided. Because only availability is affected (A:L) and authentication is required, this is a degradation-of-service nuisance rather than a path to data theft or code execution.