EUVD-2026-81084
GHSA-ppx7-gfch-p72q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SQLi requiring low-privileged authentication (PR:L), no user interaction; SQL injection typically yields full database read/write and DoS, so C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
3DescriptionCVE.org
Tanium addressed a SQL injection vulnerability in Threat Response.
AnalysisAI
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-privileged, authenticated user to inject crafted input over the network and manipulate the backend SQL queries, producing high confidentiality, integrity and availability impact on the affected component. Exploitation requires a valid Threat Response console account or API credentials at low privilege (PR:L) plus network reachability to the management interface, but needs no user interaction and involves low attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid authenticated access to Tanium Threat Response at a low privilege level (CVSS PR:L) - the attacker must already have a working account or API credentials to the console. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-reachable, low-complexity SQL injection that requires only low-level authentication (PR:L) and no user interaction, yielding full confidentiality, integrity and availability impact on the affected component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: obtain the fixed Threat Response build per Tanium advisory TAN-2026-047 (https://security.tanium.com/TAN-2026-047) and upgrade; the exact patched version number is not disclosed in the available data, so confirm the fixed build against the advisory before closing the finding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Tanium Threat Response deployment and determine which management interfaces are reachable from broad internal networks or the internet; simultaneously review all console and API accounts, disable or downgrade non-essential low-privilege accounts, and rotate API credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Threat Response
View allAn authenticated server-side request forgery (SSRF) in Tanium Threat Response allows a user who already holds valid cons
Improper access controls in Tanium Threat Response let an attacker who already holds a valid low-privileged account mani
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.9 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.9 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.3 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.3 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.3 MEDIUM]
Improper access controls in Tanium Threat Response let an authenticated, high-privilege operator (PR:H) reach a function
Information disclosure vulnerability in Tanium Threat Response allows high-privileged authenticated users to access sens
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today