EUVD-2026-81086
GHSA-hx2p-hm52-j526
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Missing-authorization abuse requires an existing high-privilege console account (PR:H) over the network (AV:N); impact is partial read and modify (C:L/I:L) with no availability effect.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
3DescriptionCVE.org
Tanium addressed an improper access controls vulnerability in Threat Response.
AnalysisAI
Improper access controls in Tanium Threat Response let an authenticated, high-privilege operator (PR:H) reach a function that lacks an adequate authorization check, allowing them to read or modify data outside their assigned scope over the network without user interaction. The vendor addressed the flaw (tracked as TAN-2026-034) and the impact is limited - confidentiality and integrity are both rated Low and there is no availability impact - yielding a CVSS 3.1 base score of 3.8. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated, high-privilege account within the Tanium Threat Response module (PR:H) - realistically an existing operator or admin, or a compromised such account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-priority issue despite being network-reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix referenced in Tanium's advisory TAN-2026-034 (https://security.tanium.com/TAN-2026-034); the advisory is the authoritative source for the specific patched Threat Response version, as no exact fix version is disclosed in the available CVE data, so patch availability is confirmed only per that vendor advisory and the mapping to installed builds must be verified against it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Threat Response
View allSQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
An authenticated server-side request forgery (SSRF) in Tanium Threat Response allows a user who already holds valid cons
Improper access controls in Tanium Threat Response let an attacker who already holds a valid low-privileged account mani
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.9 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.9 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.3 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.3 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.3 MEDIUM]
Information disclosure vulnerability in Tanium Threat Response allows high-privileged authenticated users to access sens
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today