Tanium Threat Response CVE-2026-6392

Exploitation requires valid high-privilege (administrator-level) credentials for Tanium Threat Response. An attacker must authenticate to the system with PR:H privilege level; remote unauthenticated users cannot exploit this vulnerability. The vulnerability does not require user interaction (UI:N) once authenticated, and no special non-default configuration is mentioned, implying it affects standard Threat Response installations.

This vulnerability presents LOW real-world risk despite its network vector, due to several mitigating factors. The CVSS score of 2.7 reflects the confluence of network accessibility (AV:N) with a critical prerequisite: high-privilege authentication (PR:H), meaning only administrators or highly privileged accounts can exploit it. EPSS data is not provided, but exploitation probability is likely very low given the authentication barrier. The vulnerability causes only confidential information disclosure (C:L) with no impact to integrity or availability (I:N, A:N), limiting its strategic value to attackers. No public exploit code or active exploitation has been reported, and the vulnerability does not cascade to system compromise. The real risk is data exposure within privileged contexts-relevant mainly for organizations with compromised administrator credentials or insider threat scenarios. Defenders should prioritize this below network-reachable vulnerabilities lacking authentication requirements.

An attacker with compromised administrator credentials or an insider with high-privilege access logs into Threat Response and sends a crafted network request to an insufficiently protected endpoint, retrieving sensitive data such as threat intelligence, investigation details, or system configuration information that should be restricted to specific administrator roles.