Tanium Threat Response CVE-2026-116653

Exploitation requires an attacker to already possess low-privilege authenticated access to the Tanium Threat Response application (CVSS PR:L), after which malformed input can be delivered remotely over the network (AV:N) with low complexity and no user interaction. The description does not name the specific feature, endpoint, configuration mode, or parameter that is improperly validated, so the exact trigger is not described in the available sources. The principal limiting factor is the authentication requirement - this is not a remote unauthenticated flaw - combined with a capped integrity-only impact (C:N/A:N) and no privilege escalation or scope change (S:U).

This is a moderate-severity (CVSS 4.3), lower-priority issue rather than an urgent threat. The vendor-supplied CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) describes a network-reachable but authenticated (PR:L) flaw with low attack complexity, no required user interaction, no scope change, and only a limited integrity impact (I:L) - no confidentiality or availability impact. The vuln.today decision label is 'this_month', consistent with a non-emergency triage window. No EPSS score, CISA KEV listing, or PoC/exploit reference is present in the supplied data, so there is no signal of active or probable exploitation - exploitation must be treated as no public exploit identified at time of analysis. One notable conflict: the 'Information Disclosure' tag implies a confidentiality impact, yet the CVSS vector sets C:N and attributes impact only to integrity (I:L); these disagree, and the sparse description ('improper input validation in Threat Response') does not resolve which is correct - verify the actual impact with Tanium advisory TAN-2026-090. Overall this reads as a genuine but low-urgency integrity defect requiring existing authenticated access, not a high-CVSS-but-overstated issue nor a widespread-exploitation risk.

An attacker who already holds low-privilege authenticated access to a Tanium Threat Response instance sends crafted, improperly validated input over the network to the affected component, producing a limited integrity impact such as unauthorized modification of data the attacker should not be able to alter. No public exploit code or PoC reference is provided, and no user interaction is required, but the attacker must first possess valid low-level credentials.