EUVD-2026-42245
GHSA-83fv-4g7p-rcp3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable management service, unauthenticated and low-complexity per vendor vector; impact is availability-only (memory exhaustion), so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (3938794e-25f5-4123-a1ba-5cbd7f104512).
CVSS VectorVendor: 3938794e-25f5-4123-a1ba-5cbd7f104512
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
Tanium addressed a denial of service vulnerability in Tanium Server.
AnalysisAI
Denial of service in Tanium Server allows remote unauthenticated attackers to exhaust availability of the platform, per vendor advisory TAN-2026-016. The flaw is network-reachable with low complexity and no privileges or user interaction (CVSS 7.5, availability-only impact), and the CWE-789 classification indicates an uncontrolled/excessive memory allocation can be triggered remotely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network reachability to the Tanium Server - remote unauthenticated exploitation with low complexity and no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are moderate and internally consistent: CVSS 3.1 base is 7.5 driven entirely by high availability impact (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H), so this is network-exploitable without authentication but cannot compromise confidentiality or integrity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network reachability to the Tanium Server sends a specially crafted request that causes the server to attempt an excessively large memory allocation, exhausting available memory and crashing or hanging the service. This disrupts endpoint management, patching, and security operations across all managed endpoints until the server is restarted or patched. … |
| Remediation | Apply the fixed Tanium Server release identified in vendor advisory TAN-2026-016 (https://security.tanium.com/TAN-2026-016); the exact patched version was not included in the input data and should be taken directly from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Restrict network access to Tanium Server to authorized systems only; enable real-time monitoring of server memory and CPU utilization for anomalous spikes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Rated critical se
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today