Tanium Discover CVE-2026-116665

Exploitation requires an authenticated account on the Tanium platform (PR:L) with network access to the Discover module; no user interaction is needed. The specific feature, configuration, or request that triggers the disclosure is not described in the available sources. Exploitation is limited by the authentication requirement and by the impact being confined to partial confidentiality (C:L) - no integrity or availability effect - meaning a valid low-privilege foothold is a prerequisite rather than fully unauthenticated remote access.

This is a moderate-severity, low-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) indicates a network-reachable but authenticated (PR:L) information disclosure with only low confidentiality impact and no integrity or availability effect. The vendor-assigned priority is 'this_month', consistent with a non-emergency fix. There is no CISA KEV listing and no public exploit or PoC reference in the supplied data (only the vendor advisory TAN-2026-094), so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was provided, so real-world exploitation probability cannot be quantified from this input. The limiting factors - required authentication and only partial confidentiality impact - keep real risk well below what a raw 'network vector' reading might suggest. The chief gap is that the description does not state what information is disclosed or how the flaw is triggered; verify affected versions and the nature of the disclosed data with the Tanium advisory before prioritizing.

An authenticated low-privilege user of the Tanium platform interacts with the Discover module over the network and is able to read information they should not be authorized to see, resulting in disclosure of sensitive data. The trigger mechanism is not described in the available sources, and no public exploit or PoC was identified at the time of analysis.