Tanium Data Service CVE-2026-14505

Exploitation requires: (1) network access to the Tanium Data Service (AV:N), (2) a highly privileged account or session within the Tanium platform (PR:H) - standard end-user or read-only credentials are insufficient, and (3) high attack complexity conditions (AC:H), implying additional prerequisites such as specific service state, race conditions, or configuration that are not detailed in the sparse vendor description. Limiting factors: the PR:H requirement restricts exploitation to Tanium admins, compromised privileged service accounts, or attackers who have already achieved deep foothold; AC:H further reduces the ease of exploitation. The vulnerability does not appear to be exploitable by unauthenticated or low-privilege network users against default Tanium deployments.

The CVSS 3.1 base score of 6.6 reflects a meaningful tension in the vector metrics: impact is maximal (C:H/I:H/A:H), suggesting potential for full file system compromise within scope, but this is substantially constrained by AC:H (high attack complexity) and PR:H (high privileges required). In practice, an attacker must already hold highly privileged access to the Tanium environment and satisfy additional attack complexity conditions - effectively narrowing the realistic threat actor pool to insider threats, compromised privileged accounts, or attackers who have already achieved significant foothold. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog, nor is a public proof-of-concept known. The real-world priority for most organizations should be moderate: patch promptly as part of routine maintenance, but this does not represent an emergency requiring immediate out-of-band response unless the Tanium environment has unusually broad privileged access exposure. The brief vendor description provides minimal technical detail, making independent impact verification difficult.

A highly privileged Tanium administrator or a threat actor who has compromised such an account sends a crafted request to the Tanium Data Service containing a path traversal sequence (e.g., '../../../etc/passwd' or similar), causing the service to access files outside its intended working directory. With high complexity requirements, the attacker may also need to satisfy specific timing or configuration preconditions. No public proof-of-concept code is known at time of analysis.