EUVD-2026-81082
GHSA-2jx4-xhg9-69q9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privilege Tanium console user
-
ExploitSubmit crafted input to Asset feature
-
ExecutionInjected SQL executes on backend database
-
ImpactExfiltrate or tamper with stored data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid high-privilege authenticated Tanium console session (PR:H) with access to the Asset module - a self-service or low-privilege account is insufficient. The vulnerability is remotely reachable over the network (AV:N) with low attack complexity and no user interaction, but is gated on the optional Asset module being deployed and on the attacker already possessing elevated credentials. Affected builds are Asset before 1.33.326, before 1.36.174, and before 1.39.153; upgrading to the fixed versions removes the exposure. The exact injectable input field/feature is not specified in the available data. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes a network-reachable, low-complexity SQL injection whose principal limiter is PR:H - the attacker must already hold a high-privilege authenticated Tanium console account. The C:H/I:H/A:H triad is plausible for SQLi (read/modify/destroy backend data), though full A:H is somewhat generous unless the injection can crash or lock the database. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net real-world priority is moderate rather than urgent: the high-privilege prerequisite means an attacker must already be a trusted, elevated operator, sharply narrowing the population of exploitable deployments and making this an insider/post-compromise privilege-abuse concern more than a mass-exploitation threat. No conflicting signals were detected - CVSS network vector is consistent with a console-facing SQLi - but note the vendor advisory (TAN-2026-046) is not independently accessible in this dataset to confirm exploitation constraints. |
| Exploit ScenarioDerived | An attacker holding a high-privilege Tanium console account submits crafted input to an Asset module feature that concatenates it into a SQL query, injecting malicious SQL against the backend database. This lets them read, alter, or destroy asset inventory data beyond their intended scope. No public POC is identified, and exploitation requires an already-authenticated privileged session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
SQL injection in the Tanium Asset module lets a high-privilege authenticated console user execute arbitrary SQL against the Asset data store, with the potential to read, modify, or destroy data the module manages (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The flaw is remotely reachable and requires no user interaction, but it is gated on two conditions: the optional Asset module must be deployed, and the attacker must already hold an elevated Tanium console session - a self-service or low-privilege account is insufficient. Affected builds are Asset before 1.33.326, before 1.36.174, and before 1.39.153; Tanium has released fixed versions and there is currently no public exploit identified at time of analysis, though the EPSS score is minimal and no CISA KEV listing applies.
Earlier versions of this analysis (1)
SQL injection in the Tanium Asset module allows an authenticated user with access to the affected Asset query interface to read and manipulate data processed by the module, with high confidentiality and integrity impact and a low availability impact (CVSS 7.5, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H as published by the vendor). Exploitation is gated by valid credentials and the ability to reach the Asset module and supply input to the vulnerable query, so unauthenticated remote attackers cannot reach it directly. Tanium addressed the flaw in its Asset component, and no public exploit code or confirmed active exploitation has been identified at time of analysis, making this a genuine but not currently emergency-tier issue; exact affected and fixed versions are not disclosed in the available data and must be confirmed against advisory TAN-2026-046.
RemediationAI
Vendor-released patch: upgrade Tanium Asset to 1.33.326, 1.36.174, or 1.39.153 (or later within the corresponding maintenance line), as documented in Tanium advisory TAN-2026-046 at https://security.tanium.com/TAN-2026-046. Until upgrades complete, the single most effective compensating control is reducing the attack surface that the PR:H prerequisite represents: audit and aggressively prune high-privilege console accounts, remove any accounts that do not strictly require Asset visibility, and enforce MFA on remaining administrators - this does not fix the injection but invalidates the credential precondition an attacker needs. Organizations that do not rely on the Asset module should consider disabling or uninstalling it, which eliminates the vulnerable code path entirely at the cost of losing endpoint asset inventory. Network-level restrictions (limiting console/API access to trusted management subnets or jump hosts via firewall or reverse-proxy ACLs) reduce AV:N reachability and carry the trade-off of constraining legitimate remote administration. If a web application firewall or database activity monitoring is in front of the Asset interface, enable SQL-injection signatures and alerting on anomalous queries as a detection layer, understanding that WAF signatures are evadable and no substitute for the patch. After upgrading, review Asset database and console logs for anomalous query patterns predating the fix to determine whether exploitation occurred.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, improper neutralization of special elements used in an SQL command, in the Tanium Asset module - the component that inventories hardware, software, and endpoint data collected by Tanium clients. Because the injection is network-reachable (AV:N) and low complexity (AC:L) with no user interaction (UI:N), the principal barrier is privilege (PR:H): an attacker must already possess a high-privilege authenticated console account and be able to reach the Asset functionality. The CPE cpe:2.3:a:tanium:asset:*:*:*:*:*:*:*:* confirms the vulnerable component is the Asset module itself rather than the core Tanium platform, and EUVD tracking (EUVD-2026-81082) plus Tanium's own reporting (TAN-2026-046) corroborate that this is a vendor-disclosed, vendor-fixed issue. The exact injectable input field or feature is not specified in the available data, so the specific query path cannot be narrowed further; the impact is bounded to the confidentiality, integrity, and availability of data reachable by the Asset database context (C:H/I:H/A:H), with scope unchanged (S:U).
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable console SQLi requiring a high-privilege account (PR:H) and no user interaction; SQLi permits full read/write/destroy of backend data, so C:H/I:H/A:H.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
4DescriptionCVE.org
Tanium addressed a SQL injection vulnerability in Asset.
Executive ViewAI
A high-severity SQL injection vulnerability in the Tanium Asset module could allow a malicious insider or compromised high-privilege console account to read, alter, or destroy critical asset data, undermining the integrity of endpoint management. Although exploitation requires an authenticated elevated session and the optional Asset module to be deployed, the potential for operational disruption and data loss warrants leadership attention. Patching is available and no public exploit identified at time of analysis, but timely remediation is essential to protect sensitive asset inventories.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB