EUVD-2026-81085
GHSA-x4m7-w7jf-mj86
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Threat Response user
-
DeliveryIdentify unprotected resource/action endpoint
-
ExploitManipulate object/scope identifier in request
-
ExecutionBypass authorization check
-
ImpactModify or trigger unauthorized response actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires an existing authenticated but low-privileged account on Tanium Threat Response (PR:L) reachable over the network (AV:N); no user interaction is needed (UI:N). The limiting factor is that the attacker must already possess valid Threat Response credentials/session - this is not exploitable by fully unauthenticated remote attackers. The exact feature, API endpoint, or configuration that exposes the improper access control is not described in the available data and must be confirmed via vendor advisory TAN-2026-048. |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) describes a network-reachable, low-complexity flaw that nonetheless requires existing low-level authentication (PR:L) - consistent with CWE-639 (authorization bypass through user-controlled key / IDOR-style improper access controls) rather than a true pre-auth 'Authentication Bypass' as the input tag claims. The elevated score is driven almost entirely by I:H (integrity), while confidentiality is only C:L and availability is unaffected (A:N), suggesting the primary risk is an authenticated user exceeding their intended authorization to modify or trigger actions they should not, with limited data exposure. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so this is currently a no-known-exploitation issue whose real-world priority rests on vendor severity alone. The single reference is a vendor-only advisory (security.tanium.com/TAN-2026-048) that is not detailed in the input, so the exact mechanism, affected version range, and fixed build cannot be independently confirmed - treat the I:H rating as vendor-asserted and verify against the advisory before prioritizing. |
| Exploit ScenarioDerived | A user who already holds a valid but low-privileged Tanium Threat Response account sends crafted API/console requests that reference resources or actions belonging to another tenant, role, or endpoint scope. Because Threat Response fails to enforce access controls on that operation, the attacker performs high-integrity actions (e.g., altering detections, configurations, or response operations) beyond their authorization. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Improper access controls in Tanium Threat Response let an attacker who already holds a valid low-privileged account manipulate objects they should not be authorized to reach, producing a high integrity impact and limited confidentiality exposure. The flaw is network-reachable and low-complexity but is not pre-authentication: the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) confirms the attacker must first authenticate with low privileges, so the 'Authentication Bypass' tag in the source intelligence should be read as an authorization bypass rather than an unauthenticated entry point. No public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation is not confirmed actively exploited; Tanium self-reported the issue and published advisory TAN-2026-048.
RemediationAI
No patch version is specified in the available input data, so the fixed release for Tanium Threat Response must be confirmed directly from Tanium's advisory TAN-2026-048 (https://security.tanium.com/TAN-2026-048) and the module upgraded to the version named there; patch status for this CVE should be treated as advisory-dependent rather than assumed. Until that upgrade is applied, prioritize compensating controls that directly address the CWE-639 root cause: audit and tighten Threat Response role-based permissions so that low-privileged accounts cannot enumerate or reference investigation, endpoint, or object identifiers outside their assigned scope, since this vulnerability's prerequisite is exactly such an authenticated low-privilege account. Restrict network reachability of the Tanium server, zone server, and Threat Response API surfaces to trusted management networks or VPN segments - this reduces the AV:N exposure but does not eliminate abuse by an insider or a compromised low-privilege account, and it can break distributed client check-ins if applied too broadly. Enable and review audit logging for anomalous object-ID access patterns (sequential or unexpected identifier references by low-privilege users) and alert on them, accepting that this is detective rather than preventive. Rotate credentials or revoke sessions for any account suspected of abuse, because the PR:L precondition means the attacker needs working credentials for the bypass to be reachable. Because no public exploit code has been identified and the flaw is not in CISA KEV, emergency measures should be balanced against operational disruption, but the I:H integrity rating argues against indefinite deferral of the vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-639, authorization bypass through a user-controlled key - commonly described as an insecure direct object reference (IDOR). In this pattern the application trusts a client-supplied identifier (an object ID, investigation ID, sensor/question identifier, or similar key) when scoping a request, and fails to verify that the requesting principal actually owns or is permitted to act on that object. Tanium Threat Response is the endpoint detection, investigation, and response module within the Tanium platform, which exposes management and query functionality over network-reachable APIs and services, meaning the vulnerable surface is remote (AV:N) and requires no user interaction (UI:N). Because the vector carries PR:L rather than PR:N, the weakness is not a true pre-authentication bypass; it is a privilege boundary failure that lets a low-privileged, already-authenticated user escalate the effect of their actions against objects outside their authorization scope. The integrity rating (I:H) indicates an attacker can modify or corrupt protected data or investigation artifacts, while the confidentiality rating (C:L) indicates only limited read exposure. The affected CPE, cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*, uses a wildcard version, so the precise vulnerable-to-fixed version boundary is not derivable from the supplied data and must be taken from the vendor advisory.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Network-reachable but requires an authenticated low-privileged account (PR:L); CWE-639 authorization flaw yields primarily integrity impact (I:H) with limited confidentiality (C:L) and no availability effect.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
4DescriptionCVE.org
Tanium addressed an improper access controls vulnerability in Threat Response.
Executive ViewAI
Tanium Threat Response, a critical endpoint security and threat hunting platform, contains an improper access control vulnerability that allows any authenticated low-privileged user to manipulate objects they are not authorized to modify, resulting in a high integrity impact and limited confidentiality exposure. This could enable a malicious insider or an attacker who has compromised a low-level account to tamper with security findings, potentially blinding security teams to real threats or causing misdirection. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, but organizations relying on Tanium for threat detection must act to protect the integrity of their security operations.
Restrict access to Tanium Threat Response to trusted administrators, enforce least privilege and multi-factor authentication, monitor audit logs for unauthorized object manipulation, and consider network segmentation to limit exposure. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB