EUVD-2026-116546
GHSA-6r5f-cj83-v9rm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege access to Threat Response
-
ExploitSubmit improperly validated input
-
ExecutionTrigger input-validation flaw (CWE-20)
-
ImpactDisclose sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires authenticated access to a Tanium Threat Response instance (PR:L), reachable over the network (AV:N), with no user interaction (UI:N) and low attack complexity (AC:L). The vendor advisory does not describe the specific feature, request, configuration setting, or input that triggers the improper input validation, so the exact prerequisites beyond holding valid low-privilege credentials are not described in the available sources. The limiting factor is the authentication requirement: an attacker must already be a legitimate (if low-privileged) user, which constrains this to insiders or attackers who have obtained valid credentials rather than fully anonymous remote actors. |
| Impact | This is a moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity flaw requiring some level of existing privilege (PR:L) that impacts confidentiality only - consistent with the 'Information Disclosure' tag and the CWE-20 improper input validation root cause. No EPSS score, CISA KEV listing, or SSVC automatable/technical-impact breakdown was supplied, so exploitation-probability signals are absent and cannot be weighed. The vuln.today priority is 'this_month' (not act_now/emergency), and there is no public exploit identified at time of analysis. The signals are internally consistent - none conflict - but the picture is thin: the only source is the vendor's own advisory. Net assessment: a credible authenticated information-disclosure bug in an enterprise security product, worth patching on a normal monthly cycle, not a drop-everything fire; the trigger mechanism is not described in the available sources. |
| Exploit ScenarioDerived | An attacker who already holds low-privilege authenticated access to a Tanium Threat Response instance submits specially crafted input that the component fails to validate, causing it to disclose sensitive information it should not return. No public proof-of-concept or exploit code is available, and the specific input and data exposed are not described in the vendor advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Improper input validation in Tanium Threat Response allows a remote, authenticated low-privilege user to disclose sensitive information, with high confidentiality impact and no integrity or availability effect at low attack complexity and no user interaction (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N). The vendor advisory does not describe the specific feature, request or input that triggers the flaw, so the only confirmed prerequisite is a valid low-privilege account, which constrains exposure to insiders or attackers who already hold credentials rather than anonymous remote actors. This is a moderate-priority issue rather than an emergency: no public exploit identified at time of analysis and the product is not in CISA KEV.
RemediationAI
Tanium has published advisory TAN-2026-083 (https://security.tanium.com/TAN-2026-083) covering this improper input validation issue; apply the Threat Response update identified there, noting that the data provided does not state an exact fixed version number, so confirm the target release in the advisory before upgrading and update both server and client components as directed by Tanium. Because exploitation requires only valid low-privilege credentials, the most effective compensating control until patching is complete is to review and tighten Threat Response role assignments - remove unnecessary low-privilege accounts and restrict access to Threat Response content to personnel who genuinely need it - with the trade-off that narrower roles reduce visibility for junior analysts and may slow investigations. Additionally, restrict network reachability of the Threat Response instance to trusted management networks and monitor for anomalous query or data-retrieval activity from low-privileged accounts, accepting that these measures reduce but do not eliminate the disclosure risk while the vulnerable version remains deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-116654 is classified as CWE-20 (Improper Input Validation) in Tanium Threat Response, the incident-response and threat-hunting module that lets operators query endpoints and retrieve investigation data through the Tanium platform. CWE-20 covers the root-cause class in which user-supplied input is accepted without sufficient validation or canonicalization, so the application processes a malformed or unexpected value in a way it was not designed to handle; here the assessed consequence is disclosure of information the caller should not be able to read, reflected in the high confidentiality metric and the unchanged scope of the CVSS vector. The CPE entry cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:* indicates a wildcard version range, meaning the advisory does not enumerate discrete affected releases in the supplied data, and the trigger - the specific request, parameter, feature or configuration setting that exercises the validation gap - is not described in the available sources. The vector's network reachability, low attack complexity and no user interaction describe how the issue is rated for severity; they do not by themselves establish the underlying trigger mechanism. The genuinely limiting factor is the PR:L requirement: the attacker must already hold valid low-privilege credentials on a reachable Threat Response instance, which places this in the credentialed-insider or stolen-credentials scenario rather than the unauthenticated internet-facing one.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable component requiring an authenticated low-privilege user (PR:L); improper input validation yields information disclosure, so C:H with no integrity or availability impact.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an improper input validation vulnerability in Threat Response.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB