EUVD-2026-81081
GHSA-3p85-82gq-6c7j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege Tanium console credentials
-
ExploitAuthenticate to Discover module
-
ExecutionIssue crafted request to disclosure endpoint
-
ImpactRetrieve sensitive information beyond authorization
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session to the Tanium Discover module (PR:L - a low-privilege Tanium console account or equivalent credential). Exploitation is network-reachable (AV:N) with low complexity and needs no user interaction, but the authentication requirement means only actors with existing console access or stolen credentials can exploit it. Impact is limited to confidentiality (information disclosure); there is no integrity or availability effect, and it is gated to environments that have licensed and deployed the optional Discover module. |
| Impact | This is a moderate-severity issue that does not rise to urgent priority. The vendor CVSS of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable information disclosure that nonetheless requires authenticated access (PR:L), which is the single largest limiting factor. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided intelligence, so all real-world exploitation signals are absent - this looks like a vendor-self-reported, proactively-patched flaw rather than something under active attack. The C:H/I:N/A:N impact profile is confidentiality-only, so worst case is data exposure with no integrity or availability consequence. The C:H rating is somewhat generous given the extremely terse one-line description ('an information disclosure vulnerability in Discover') that names no specific data class; the vendor advisory TAN-2026-024 would be needed to confirm what is actually disclosed and to whom. Net: a real but not high-priority patch item, best prioritized on internal Tanium consoles rather than treated as an internet-facing emergency. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege but valid Tanium console/Discover account (or has compromised such credentials) sends crafted requests to the Discover module and retrieves sensitive information they should not be able to view. No user interaction or elevated privileges are required beyond the initial authenticated foothold, and no public exploit code is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Information disclosure in the Tanium Discover module allows an authenticated console user to read data they should not have access to, with the vendor confirming the flaw has been addressed. The vulnerability requires network reachability and a valid low-privilege Tanium session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) but no user interaction, and it affects only organizations that have licensed and deployed the optional Discover component. Impact is confined to confidentiality - there is no integrity or availability effect - and no public exploit code or confirmed active exploitation has been identified at time of analysis.
RemediationAI
Apply the Tanium fix referenced in advisory TAN-2026-024 (https://security.tanium.com/TAN-2026-024); the advisory states the issue has been addressed, so upgrade Discover to the vendor-designated fixed build - the exact version is not specified in the available data and must be read from the advisory before scheduling the change. Because exploitation requires a valid low-privilege console session (PR:L), the most effective compensating control until the upgrade completes is to audit and prune Tanium console accounts, enforce least privilege on the Discover role, and remove standing access for users who do not need discovery data - accepting that this narrows operational flexibility for legitimate scanning administrators. Additional hardening includes restricting network access to the Tanium server and Discover endpoints to trusted management subnets or VPN ranges, and enabling console/API audit logging to detect unusual read patterns; blocking console port access outright would break legitimate management workflows and is not practical as a standalone mitigation. Rotation of credentials and session tokens is prudent if compromise is suspected, since stolen credentials are the realistic attack path for a PR:L issue. No vendor-released patch version, workaround, or exploit-status detail beyond the advisory reference is available in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tanium Discover is an optional Tanium module used for asset discovery and network scanning within the Tanium endpoint management platform; it maintains inventory and scan-related data surfaced through the Tanium console and API. The flaw is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning the root cause is improper enforcement of authorization or output filtering on data that the Discover module returns, rather than a memory-safety or injection defect. The CVSS vector confirms the mechanics: AV:N (reachable over the network), AC:L (no special conditions), PR:L (attacker must already hold a low-privileged authenticated session), UI:N (no victim interaction), S:U (impact stays within the vulnerable component), and C:H/I:N/A:N (high confidentiality loss only). Because the CPE entry is a wildcard (cpe:2.3:a:tanium:discover:*), the advisory covers the Discover product line broadly rather than a single pinned build, so version-specific exposure must be confirmed against the vendor advisory TAN-2026-024.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Authenticated Tanium console access is required (PR:L) over the network (AV:N); confidentiality-only impact (C:H, generous for a terse description) with no integrity or availability effect.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an information disclosure vulnerability in Discover.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB