EUVD-2026-116552Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege Tanium account
-
ExploitReach Discover network interface
-
ExecutionBypass improper authorization check
-
ImpactRead restricted information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an already-authenticated low-privilege account on Tanium Discover (PR:L), since this is an improper authorization (CWE-863) flaw rather than a pre-auth bypass. The high attack complexity (AC:H) indicates additional conditions beyond the attacker's control must be met, though the available sources do not describe the specific trigger. Impact is limited to partial confidentiality disclosure (C:L) with no integrity or availability effect, which materially bounds realistic risk. No affected or fixed version range or specific configuration prerequisite is stated in the available input beyond the product being Tanium Discover. |
| Impact | This is a low-severity issue (CVSS 3.1 base 3.1) and the available signals are consistent in pointing to low real-world urgency. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) describes a network-reachable flaw that nonetheless requires existing low-level privileges (PR:L), carries high attack complexity (AC:H), and yields only limited confidentiality impact with no integrity or availability impact. The vuln.today Decision label is 'monitor', the lowest-urgency tier, which aligns with the low score. There is no CISA KEV listing and no EPSS score was supplied in the input, so widespread or active exploitation is not indicated. The sole reference is a Tanium vendor advisory (TAN-2026-091), not a proof-of-concept, so no public exploit is evident. No signals conflict here: a CWE-863 improper-authorization weakness that leaks only limited information to an already-authenticated user is a genuine low-priority item rather than a high-CVSS-but-low-risk anomaly. The main data gap is that no EPSS probability was provided and the description is a single sentence, so the precise mechanism and scope of the access-control failure cannot be independently verified beyond the vendor advisory. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authenticated account on a Tanium Discover deployment abuses an improper authorization check to read information they should not be able to access. The high attack complexity suggests the condition is not trivially reproducible, and no public exploit code or PoC is available. Impact is limited to disclosure of some confidential data, with no integrity or availability effect. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Improper access controls in Tanium Discover allow an authenticated low-privilege user to disclose limited confidential information over the network, with no integrity or availability impact. The issue carries a low CVSS 3.1 base score and the available signals support a monitor priority; no public exploit has been identified at time of analysis. Tanium's TAN-2026-091 advisory is the vendor reference for the addressed flaw.
RemediationAI
Apply the Tanium fix referenced in advisory TAN-2026-091 (https://security.tanium.com/TAN-2026-091); the supplied data indicates Tanium addressed the issue, so a patch is available per the vendor advisory, but no exact fixed version number is provided, so confirm the applicable patched release in that advisory. No workaround is described in the available sources. Because exploitation requires an authenticated low-privilege account (PR:L), review which low-privilege accounts have Discover access while planning the update; this is a precaution rather than a documented vendor workaround.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tanium Discover is a module within Tanium's endpoint management platform used for asset discovery. The flaw is classified as CWE-863 (Incorrect Authorization), meaning an authorization decision can be bypassed or misapplied for an authenticated low-privilege user; although the input tags it as an authentication bypass, the assessed vector requires PR:L and the CWE is improper authorization, so it is not a pre-authentication bypass. The CVSS vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N shows network reachability, high attack complexity, low privileges required, no user interaction, and only partial confidentiality impact; the sources do not describe the specific trigger or configuration condition that makes exploitation possible. The CPE cpe:2.3:a:tanium:discover:*:*:*:*:*:*:*:* identifies Tanium Discover but uses a wildcard version, so exact affected releases are not established by the supplied data.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Improper authorization reachable over the network but requiring an existing low-privilege account (PR:L) and hard-to-meet conditions (AC:H), leaking only limited data (C:L), no integrity or availability impact.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an improper access controls vulnerability in Discover.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
GitHub PoC
Exploit-DB