What is the CVSS score of CVE-2026-9156?

CVE-2026-9156 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9156?

Yes, a patch is available for CVE-2026-9156. Update the affected software to the latest version immediately.

Tanium Server CVE-2026-9156

EUVD-2026-32034 MEDIUM

Missing Release of Resource after Effective Lifetime (CWE-772)

2026-05-27 3938794e-25f5-4123-a1ba-5cbd7f104512

GHSA-8987-p6rf-jvmc

Denial Of Service Server

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:41 vuln.today

Patch available

May 27, 2026 - 19:46 EUVD

DescriptionCVE.org

Tanium addressed a denial of service vulnerability in Tanium Server.

AnalysisAI

Authenticated network-accessible denial of service in Tanium Server affects three active release branches, patched in versions 7.6.4.2190, 7.7.3.8274, and 7.8.2.1176. The vulnerability stems from a CWE-772 resource leak - allocated resources are not released after their effective lifetime, enabling a low-privileged authenticated attacker to exhaust server resources. A notable conflict exists in the available data: the CVSS vector reports C:H/I:N/A:N (high confidentiality impact, no availability impact) while the CVE description, ENISA EUVD tags, and vendor advisory title all characterize this as a denial of service; defenders should treat both confidentiality and availability as potentially affected until Tanium clarifies. No public exploit is identified and EPSS is low at 0.03%.

Technical ContextAI

Tanium Server is an enterprise endpoint management and security platform used in large-scale IT environments, often with privileged access to managed endpoints. The root cause is CWE-772 (Missing Release of Resource after Effective Lifetime), a class of resource management flaw where the server allocates memory, file handles, or connections but fails to free them under certain conditions, leading to progressive exhaustion. Affected CPE-equivalent versions span three maintained branches: 7.6.4.x (prior to 7.6.4.2190), 7.7.3.x (prior to 7.7.3.8274), and 7.8.2.x (prior to 7.8.2.1176) per ENISA EUVD-2026-32034. The CVSS attack vector is Network with Low complexity, meaning the resource leak is triggerable remotely without special conditions beyond holding a low-privilege account on the Tanium Server.

RemediationAI

The primary remediation is to upgrade Tanium Server to the patched builds released by Tanium: version 7.6.4.2190 for the 7.6.4 branch, version 7.7.3.8274 for the 7.7.3 branch, or version 7.8.2.1176 for the 7.8.2 branch. The vendor advisory is available at https://security.tanium.com/TAN-2026-013 and should be consulted for full upgrade instructions and any release notes. If immediate patching is not feasible, a compensating control would be to restrict access to the Tanium Server management interface to a minimal set of known-good, privileged service accounts only, reducing the pool of low-privilege identities that could trigger the resource leak. Additionally, network-level access control lists (ACLs) limiting which subnets can reach the Tanium Server's management ports would reduce the attack surface, though this does not eliminate the vulnerability. Monitor server resource utilization (memory, file handles, thread pools) for anomalous growth as an indicator of exploitation attempts. Note that both the confidentiality and availability implications remain unclear pending full advisory review.