Tanium Asset CVE-2026-86865

Exploitation requires an authenticated, high-privilege account on the Tanium Asset module (CVSS PR:H) with network access to the Asset interface; no user interaction is needed. The vulnerable component is the Asset module's handling of user-supplied input in a SQL query, but the specific parameter/feature is not named in the vendor description. The primary limiting factors are the high-privilege authentication requirement (a low-privilege or unauthenticated user cannot reach this) and the fact that Tanium is an internally-deployed enterprise platform rather than an internet-exposed default service, so realistic abuse is largely by insiders or attackers who have already escalated to a privileged Asset role. Fixed in Asset 1.39.153, 1.36.174, and 1.33.326.

This is a genuine but access-gated priority. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) shows network-reachable, low-complexity exploitation with no user interaction and full CIA impact, but PR:H means the attacker must already hold high-privilege authenticated access to the Tanium Asset module - this is the single most important limiter and keeps the real-world risk below what the 7.2 headline suggests. Publicly available exploit code exists (a GitHub gist), which raises the practical likelihood of exploitation by an insider or an attacker who has already compromised a privileged Tanium account; however, this is not the same as active exploitation. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of widespread or automated exploitation - treat this as no public exploitation confirmed despite POC availability. Signals are internally consistent (vendor-reported by Tanium, patch available, POC present), with no contradiction between the CVSS vector and the description. Net: patch promptly given the public POC and full-impact SQLi, but the PR:H requirement means this is not a mass-exploitable internet-facing bug.

An attacker with a high-privilege authenticated account on the Tanium Asset module (or an insider, or an attacker who has already compromised such credentials) submits crafted input to an Asset feature that is concatenated unsanitized into a SQL query, injecting attacker-controlled SQL. Because a public POC gist exists, the barrier to weaponizing this is low once privileged access is obtained, allowing the attacker to read, modify, or destroy backend Asset database contents.