EUVD-2026-81086
GHSA-hx2p-hm52-j526
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with high-privilege Threat Response account
-
ExploitSend request to under-protected function
-
ExecutionBypass missing authorization check
-
ImpactRead or modify out-of-scope data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated, high-privilege account within the Tanium Threat Response module (PR:H) - realistically an existing operator or admin, or a compromised such account. Exploitation targets a specific function protected by a missing/insufficient authorization check, letting the actor access or alter data beyond their assigned scope. The high-privilege prerequisite is the primary limiting factor; no user interaction is needed (UI:N) and no availability impact occurs. The vendor description does not specify a required feature, configuration mode, or affected version, so the exact vulnerable component is not disclosed in the available data. |
| Impact | This is a low-priority issue despite being network-reachable. The CVSS 3.1 base score of 3.8 (Low) is anchored by PR:H - exploitation requires an attacker to already hold high-privilege authenticated access to the Tanium Threat Response console - and by partial-only impact (C:L/I:L/A:N), meaning limited information disclosure and limited data tampering with no availability effect. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so all live-exploitation signals are absent. The scenario is a trusted-but-over-privileged insider or a compromised admin account abusing a missing-authorization check to reach data/actions beyond their intended scope, not mass remote exploitation. The 'Authentication Bypass' tag conflicts with the actual data: CWE-862 (Missing Authorization) plus PR:H describes an authenticated authorization gap, not an authentication bypass - treat that tag as inaccurate. The description is extremely terse ('addressed an improper access controls vulnerability') and lists no affected versions, so precise remediation targeting requires consulting Tanium advisory TAN-2026-034 directly. |
| Exploit ScenarioDerived | An authenticated Tanium operator holding a high-privilege Threat Response role sends crafted API/console requests that a missing authorization check fails to reject, allowing them to read or modify Threat Response data outside their intended permission scope. No public exploit code or active exploitation is identified at time of analysis, and the terse vendor description provides no technical trigger detail. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Improper access controls in Tanium Threat Response let an authenticated, high-privilege operator (PR:H) reach a function that lacks an adequate authorization check, allowing them to read or modify data outside their assigned scope over the network without user interaction. The vendor addressed the flaw (tracked as TAN-2026-034) and the impact is limited - confidentiality and integrity are both rated Low and there is no availability impact - yielding a CVSS 3.1 base score of 3.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the high-privilege prerequisite plus narrow scope keep real-world risk low.
RemediationAI
Apply the fix referenced in Tanium's advisory TAN-2026-034 (https://security.tanium.com/TAN-2026-034); the advisory is the authoritative source for the specific patched Threat Response version, as no exact fix version is disclosed in the available CVE data, so patch availability is confirmed only per that vendor advisory and the mapping to installed builds must be verified against it. Until the module is upgraded, treat the high-privilege prerequisite as the primary control: enforce least privilege on Threat Response roles, remove or downgrade dormant operator and administrator accounts, and review RBAC assignments so that no operator holds scope broader than their job requires - the trade-off is operational friction, as tightly scoped roles can block legitimate cross-investigation work and may require temporary role grants. Because exploitation requires an existing privileged session, credential hygiene is directly effective: rotate Threat Response operator credentials, require strong authentication for module access, and alert on anomalous privileged actions (unusual queries, evidence access, or configuration reads) from accounts whose scope should not permit them; this detection approach is compensating rather than preventive and will not stop an insider who already holds the role legitimately. Network-level restriction of the module's management interfaces to trusted administrative segments reduces exposure to external or lateral attackers but does not mitigate an insider or a compromised privileged session, and it can disrupt legitimate distributed console access. There is no availability impact, so no failover or capacity workaround is needed; the remediation focus is authorization correctness and privilege minimization.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization): a server-side function within the Tanium Threat Response module performs an action without verifying that the calling principal holds the privileges that action requires. Because Tanium agents and module servers communicate over the network, the flaw is reachable remotely (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), but the attacker must already hold a high-privilege account in the Threat Response module (PR:H) - realistically an existing operator or administrator, or someone who has compromised such an account. The CVSS scope is unchanged (S:U), and the realized impact is confined to Low confidentiality and Low integrity loss, which is consistent with an authorization gap that exposes a bounded set of data or operations rather than a full privilege-escalation chain to the underlying host. The CPE string cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:* confirms the affected component is the Threat Response product, but the vendor advisory does not disclose the specific vulnerable function, the required feature/configuration mode, or a version range, so the exact affected builds and code path remain unspecified in the available data. This class of defect typically arises when a new endpoint or API parameter is added to a privileged workflow and the authorization middleware is not applied to it, or when an object-level check (e.g., verifying the caller owns or is scoped to the queried investigation, saved question, or evidence record) is omitted.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Missing-authorization abuse requires an existing high-privilege console account (PR:H) over the network (AV:N); impact is partial read and modify (C:L/I:L) with no availability effect.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an improper access controls vulnerability in Threat Response.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB