Tanium Threat Response CVE-2026-116652

Exploitation requires a valid authenticated account with at least low privileges on the target Tanium Threat Response instance (CVSS PR:L); it is not exploitable by fully unauthenticated attackers. The flaw is network-reachable (AV:N) with low attack complexity (AC:L) and needs no user interaction (UI:N). The available sources do not describe the specific feature, protocol, or configuration setting that triggers the business-logic error, so no non-default configuration prerequisite can be confirmed. The primary limiting factor is the authentication requirement, which confines exploitation to users or attackers who have already obtained valid Threat Response credentials.

This is a moderate-severity issue (CVSS 4.3) that does not rise to the level of an urgent priority. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) describes a network-reachable, low-complexity flaw that nonetheless requires low-level authentication (PR:L) and yields only limited integrity impact (I:L) with no confidentiality or availability impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so there is no evidence of active or at-scale exploitation. The vuln.today decision label is 'this_month', consistent with a bounded, patch-on-normal-cycle item rather than an emergency. One notable conflict in the data: the 'Information Disclosure' tag implies a confidentiality impact, yet the vendor CVSS vector explicitly sets C:N and places the impact on integrity (I:L) - this discrepancy should be reconciled against the Tanium advisory (TAN-2026-081) before relying on either characterization. The description ('a business logic error in Threat Response') does not state the trigger mechanism, so the precise nature of the flaw is unverified from the available sources.

An attacker who already holds a low-privilege authenticated account on a Tanium Threat Response instance sends network requests that abuse a business-logic flaw to perform an action or alter state the account should not be permitted to affect. Because the impact is limited to integrity (I:L) with no confidentiality or availability effect per the CVSS vector, the realistic outcome is a bounded unauthorized modification rather than full data exposure or takeover. No public proof-of-concept or exploit code has been identified.