What is the CVSS score of CVE-2026-11925?

CVE-2026-11925 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-11925?

Yes, a patch is available for CVE-2026-11925. Update the affected software to the latest version immediately.

Tanium Server CVE-2026-11925

EUVD-2026-46405 LOW

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-21 Tanium

GHSA-34cg-jxcc-fq48

Information Disclosure Tanium Server Tanium

2.7

CVSS 3.1 · Vendor: Tanium

Severity by source

Vendor (Tanium) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

2.7 LOW

High privileges required for console access; only limited integrity impact from UI misrepresentation; no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Tanium).

CVSS VectorVendor: Tanium

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 21, 2026 - 23:36 EUVD

Analysis Generated

Jul 21, 2026 - 21:12 vuln.today

DescriptionCVE.org

Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.

AnalysisAI

UI Misrepresentation of Critical Information in Tanium Server enables a highly privileged network-accessible attacker to alter how critical data is presented within the administrative interface, potentially causing other operators to make incorrect security decisions based on falsified or obscured information. Classified under CWE-451, the flaw carries a CVSS score of 2.7 (Low), reflecting the high privilege barrier required for exploitation. No public exploit identified at time of analysis, and no CISA KEV listing has been associated with this vulnerability.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes vulnerabilities where software displays information in a misleading or manipulated way, causing users to act on inaccurate data. Tanium Server is an enterprise-grade endpoint management and security platform used to monitor, manage, and remediate large fleets of endpoints in corporate and government environments. The CPE string cpe:2.3:a:tanium:tanium_server:*:*:*:*:*:*:*:* indicates all versions of the server application are listed as affected, with no upper or lower version bounds provided by NVD data. The vulnerability is reachable over the network (AV:N) but requires administrative-level credentials (PR:H), meaning exploitation is constrained to those with existing high-privilege access to the Tanium Server interface.

RemediationAI

Consult the Tanium vendor advisory at https://security.tanium.com/TAN-2026-017 for the authoritative patch guidance. Patch available per vendor advisory, but an exact fixed version number was not confirmed from the available intelligence data - organizations should verify the patched release directly with Tanium. As a compensating control, restrict Tanium Server administrative access strictly to trusted personnel through role-based access controls and enforce multi-person review for critical security actions taken within the console, reducing the impact of any UI misrepresentation. Audit admin-level accounts and enforce least-privilege principles to minimize the number of accounts that could exploit this flaw.