EUVD-2026-116556Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Tanium Discover with low privileges
-
ExploitSubmit request triggering uncontrolled resource consumption
-
ExecutionExhaust service resources
-
ImpactDegrade or deny Discover availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated access at a low privilege level (CVSS PR:L) to the Tanium Discover module, reachable over the network (AV:N) with low attack complexity (AC:L) and no user interaction. The affected product is the Tanium Discover asset-discovery component specifically - not the broader Tanium platform. The description does not name a particular feature, protocol, or configuration setting that must be enabled, nor does it state the triggering input, so no non-default configuration prerequisite can be confirmed. The principal limiting factor is the authentication requirement: an attacker must already possess valid Discover credentials, which restricts this to insiders or actors who have obtained access, and the impact is confined to availability degradation (no data exposure or modification). |
| Impact | This is a genuinely low-priority issue despite being a tracked CVE, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) yields only 4.3 (Medium) because the sole impact is a limited availability loss (A:L) with no confidentiality or integrity effect, and exploitation requires existing low-level authenticated access (PR:L) to Tanium Discover. The vuln.today decision label is 'this_month', the second-lowest urgency tier, which aligns with the low CVSS. There is no EPSS score, no CISA KEV listing, and no public PoC in the provided data, so there is no evidence of active or imminent exploitation. The classification (CWE-400, uncontrolled resource consumption, Denial Of Service tag) matches the A:L-only impact. The one caveat is evidentiary rather than contradictory: the Tanium description is a single sentence and does not describe how the flaw is triggered, so the mechanism cannot be independently verified. Net assessment: a real but minor availability bug requiring authentication - patch on a normal maintenance cadence, not an emergency. |
| Exploit ScenarioDerived | An attacker who already holds low-privileged authenticated access to a Tanium Discover instance sends one or more requests that cause the service to consume excessive resources, degrading its availability for legitimate users. The specific trigger is not described in the available sources. No public exploit code or PoC is referenced, so any attack would require the actor to independently discover the triggering input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Tanium Discover contains an uncontrolled resource consumption flaw (CWE-400) that a network-reachable, low-privileged authenticated user can trigger to degrade availability, rated CVSS 4.3 with impact limited to a low availability loss and no confidentiality or integrity effect. Only the Discover asset-discovery module is affected, not the wider Tanium platform, and the sources do not specify which feature or input triggers the resource exhaustion. There is no KEV listing and no public exploit identified at time of analysis; this is a low-priority item despite being a tracked CVE, with the authentication prerequisite being the principal limiting factor.
RemediationAI
No exact fixed version is stated in the available data; the Tanium security advisory TAN-2026-098 at https://security.tanium.com/TAN-2026-098 is the authoritative source for which releases contain the fix, and upgrading Tanium Discover to a release the advisory lists as remediated is the primary action. Per the supplied data no vendor-released patch version is identified at time of analysis, so patch status should be confirmed against that advisory rather than assumed. Because exploitation requires authenticated low-privileged access to the Discover module and results only in availability degradation, the practical compensating control is to restrict Discover access to trusted administrative accounts and reduce the number of low-privilege credentials that can reach the module, with the trade-off that legitimate discovery and asset-inventory workflows performed by those accounts are curtailed, and to monitor for resource-exhaustion symptoms on Discover services so that abusive authenticated usage is detected and the responsible accounts disabled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an uncontrolled resource consumption (CWE-400) weakness in Tanium Discover, the asset-discovery component of the Tanium endpoint management platform, tracked under CPE cpe:2.3:a:tanium:discover. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L indicates the flaw is reachable over the network with low attack complexity and no user interaction, but requires low-privileged authenticated access, stays within a single security scope, and results only in partial availability impact. The referenced CWE class covers failures to bound or throttle consumption of memory, CPU, disk, or connection resources, but the available sources do not describe the specific feature, protocol, request pattern, or configuration setting involved, so the trigger mechanism and any non-default prerequisites remain unconfirmed. Impact is bounded to availability degradation; there is no evidence of data exposure or modification.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Authenticated (PR:L) network-reachable request causes a limited availability-only impact (A:L); no confidentiality or integrity effect and no scope change, consistent with CWE-400 DoS.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an uncontrolled resource consumption vulnerability in Discover.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
GitHub PoC
Exploit-DB