What is the CVSS score of CVE-2026-9207?

CVE-2026-9207 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Tanium Connect are affected by CVE-2026-9207?

Tanium Connect versions 5.26, 5.29, and 5.37 contain an OS command injection vulnerability that permits authenticated low-privilege users to execute arbitrary commands and gain full control of…. A patch is available.

How to fix or mitigate CVE-2026-9207?

24 hours: Enumerate all Tanium Connect deployments and identify systems running affected branches (5.26, 5.29, 5.37 below fixed builds). 7 days: Apply vendor-released patch to all identified instances per Tanium advisory. 30 days: Confirm patch deployment across endpoint inventory, review authentication and command execution logs for suspicious activity during exposure window, and document remediation completion.

Tanium Connect CVE-2026-9207

EUVD-2026-32035 HIGH

OS Command Injection (CWE-78)

2026-05-27 3938794e-25f5-4123-a1ba-5cbd7f104512

GHSA-4p47-gj2p-5wr9

Command Injection RCE Connect

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:39 vuln.today

Patch available

May 27, 2026 - 19:46 EUVD

DescriptionCVE.org

Tanium addressed an unauthorized code execution vulnerability in Connect.

AnalysisAI

OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the underlying host, yielding full confidentiality, integrity, and availability compromise (CVSS 8.8). The flaw affects Connect branches 5.26, 5.29, and 5.37 below their respective fixed builds and is tagged as RCE/Command Injection. There is no public exploit identified at time of analysis, and EPSS estimates exploitation probability at a low 0.07% (22nd percentile).

Technical ContextAI

Tanium Connect is the data-export/integration module of the Tanium endpoint-management platform, used to route endpoint and inventory data to external destinations (SIEMs, databases, files, HTTP endpoints, etc.). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning attacker-influenced input reaches a shell or process-execution call without adequate sanitization, allowing operating-system commands to be injected and run in the context of the Connect/Tanium service. Because Connect typically runs server-side with significant privileges on the Tanium platform host, command injection here translates into code execution on management infrastructure rather than on a single endpoint. No CPE strings were provided; affected components are identified by vendor version branches (5.26.x, 5.29.x, 5.37.x).

RemediationAI

Upgrade Tanium Connect to a fixed build for your branch: 5.26.191 or later for the 5.26 line, 5.29.237 or later for the 5.29 line, and 5.37.140 or later for the 5.37 line (Vendor-released patch per advisory TAN-2026-014, https://security.tanium.com/TAN-2026-014; fixed versions inferred from the EUVD 'affected versions' upper bounds). If immediate patching is not possible, reduce exposure by tightening who holds Connect/Tanium accounts and roles capable of creating or editing Connect connections/destinations, since PR:L means a valid low-privileged account is the precondition - revoke or restrict non-essential Connect operators and audit recent connection configurations for tampering. Additionally, restrict network access to the Tanium Server/Connect management interface to trusted administrative networks to limit who can reach the authenticated attack surface; the trade-off is reduced convenience for distributed administrators. Review the vendor advisory for any official interim workaround before relying solely on access controls.