Tanium Provision CVE-2026-87085

Exploitation requires an authenticated, low-privileged session to Tanium Provision (CVSS PR:L), so a valid account or foothold in the Provision application is a prerequisite - this is not reachable by a fully unauthenticated attacker. The affected product is the Tanium Provision module specifically; affected builds are Provision 1.17 before 1.17.150, 1.23 before 1.23.161, and 1.24 before 1.24.199, so deployments already on or above those fixed builds are not exploitable. The precise vulnerable feature, endpoint, or parameter is not described in the available sources. The main limiting factors are the authentication requirement and the vendor's constrained Low confidentiality/integrity/availability impact; no user interaction is required (UI:N).

This is a moderate-severity, authenticated SQL injection (CWE-89) in Tanium Provision, vendor-rated CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The CVSS vector indicates a network-reachable, low-complexity attack but requires low-level privileges (PR:L), so an authenticated session or account is a prerequisite - it is not an unauthenticated internet-facing bug. Impact is rated Low across confidentiality, integrity and availability with an unchanged scope, which is conservative for a SQLi class that can often reach full database read/write; the vendor's L/L/L rating suggests the injection point is constrained in what it can reach. No EPSS score, CISA KEV listing, or public exploit/PoC reference is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month,' consistent with a patch-available, authenticated, medium-severity issue that warrants scheduled remediation rather than emergency response. Key missing signals: EPSS probability and PoC status are both absent, and the vendor advisory (TAN-2026-023) was not fetched, so the exact injectable parameter and reachable data are unverified from the provided inputs.

An attacker who already holds a low-privileged authenticated account in Tanium Provision submits crafted input to a vulnerable parameter, injecting SQL that the backend executes. Depending on the injection context this could expose or modify provisioning data held in the database. No public exploit code or PoC reference is provided, and the specific vulnerable parameter is not described in the available sources.