Tanium Threat Response CVE-2026-116651

The available sources give only that this is an OS command injection (CWE-78) 'unauthorized code execution' flaw in Tanium Threat Response; the specific feature, parameter, or configuration that carries the injectable input is not described in the available sources. Per the supplied CVSS vector, exploitation requires network reachability (AV:N) plus some existing low-level privilege (PR:L), i.e. authenticated access, and succeeds only under conditions outside the attacker's control (AC:H), so it is not reliably repeatable; no user interaction is needed (UI:N). The PR:L metric is the key limiting factor and appears to conflict with the 'unauthorized' label - defenders should confirm from TAN-2026-088 whether a valid Tanium account is genuinely required. The vendor advisory indicates updating as the resolution.

Signals are mixed and the underlying evidence is thin. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes a network-reachable flaw that nonetheless requires some level of existing privilege (PR:L) and has high attack complexity (AC:H), meaning conditions outside the attacker's control must be met - so it is not a trivially sprayable bug. The vuln.today decision label is 'this_week', which indicates meaningful but not emergency urgency. No EPSS score, no CISA KEV listing, and no confirmed proof-of-concept are present in the input, so there is no evidence of active exploitation or published exploit code; the only reference is the Tanium vendor advisory (TAN-2026-088), which is an advisory, not verified working exploit code. Note a tension between the labeling and the vector: the product name and tags call this 'unauthorized code execution' / RCE, yet the CVSS vector encodes PR:L (authenticated) rather than PR:N - this discrepancy should be verified against the Tanium advisory, as it materially changes whether a valid Tanium account is a precondition. On balance this is a credible, high-impact issue worth prompt patching, but the AC:H and PR:L metrics plus the absence of exploitation signals argue against treating it as an immediate drop-everything emergency.

An attacker with low-level authenticated access to a Tanium Threat Response deployment submits crafted input that is passed unsanitized into an OS command (CWE-78), causing arbitrary commands to run in the product's context. Because the CVSS vector sets AC:H, successful exploitation depends on conditions beyond the attacker's direct control, so it is not reliably repeatable against every instance. No verified public exploit code was identified at the time of analysis; the trigger mechanism is not described in the available sources.