EUVD-2026-32667
GHSA-2qj8-f68j-jw3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege Tanium account
-
DeliverySubmit crafted input to Connect feature
-
ExploitInject OS command via unsanitized field (CWE-78)
-
ExecutionExecute arbitrary commands on Connect host
-
ImpactFull host compromise (C:H/I:H/A:H)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated access to Tanium Connect at a low privilege level (CVSS PR:L), reachable over the network (AV:N) with no user interaction (UI:N) and low attack complexity (AC:L). The concrete prerequisite is the ability to authenticate to and supply input to a Connect feature that constructs an OS command (per CWE-78 and the Command Injection tag) - an attacker without any valid Tanium credentials cannot reach this path. The limiting factor is therefore the authentication requirement: this is not a fully unauthenticated, internet-spray exploit; an attacker must already possess at least low-privilege access to the Tanium environment. The exact Connect feature/configuration field that accepts the injected input was not detailed in the provided data - consult advisory TAN-2026-015 for specifics. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity attack requiring only low-level privileges and no user interaction, with high impact across all three security properties - a realistic priority for organizations running Connect, especially since exploitation needs no victim interaction. However, PR:L means the attacker must first hold some authenticated foothold, which narrows exposure compared to a fully unauthenticated RCE. No EPSS score was supplied, so exploitation probability cannot be quantified; the CVE is not in CISA KEV and no POC is referenced, so there is no signal of active exploitation or available exploit code. Net assessment: a high-severity authenticated RCE worth prompt patching, but absent KEV/POC/EPSS signals it appears to be a vendor-disclosed issue rather than one under known active attack - verify EPSS and monitor for POC publication. |
| Exploit ScenarioDerived | An attacker with a low-privilege authenticated account on the Tanium platform crafts malicious input into a Connect configuration or job that is passed to an OS command, injecting their own commands that execute on the Connect host. Because no user interaction is required and complexity is low, the attacker gains arbitrary code execution and can pivot from the management plane to broader endpoint compromise. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 27, 2026
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run arbitrary commands on the host, achieving full compromise of confidentiality, integrity, and availability. The CVSS 8.8 (network vector, low complexity, low privileges, no user interaction) reflects an authenticated remote code execution issue rooted in command injection (CWE-78). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; EPSS data was not provided.
RemediationAI
Patch available per vendor advisory - apply the fixed Tanium Connect release described in Tanium security advisory TAN-2026-015 (https://security.tanium.com/TAN-2026-015); the exact fixed version was not in the provided data and must be obtained from that advisory. Until patching is complete, reduce exposure by tightening who can authenticate to and configure Connect (the attack requires low-privilege access, so restricting Connect console/configuration permissions to a minimal set of trusted administrators directly limits the attack surface, at the cost of operational flexibility for integration owners), restricting network reachability of the Connect/Tanium server management interfaces to trusted administrative networks, and auditing Connect destination/configuration objects for anomalous or injected command content. Confirm any workaround against TAN-2026-015, as vendor guidance may supersede these compensating controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tanium Connect is the data-export/integration module of the Tanium endpoint management platform, used to forward endpoint and inventory data to external destinations (SIEMs, databases, files, HTTP endpoints). The affected component is identified by CPE cpe:2.3:a:tanium:connect (all versions enumerated). The root-cause class is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning attacker-controlled input reaches an operating-system command interpreter without adequate sanitization, allowing injected commands to execute in the context of the Connect process. The vendor and tags (RCE, Command Injection) corroborate that this is an OS command-injection path leading to code execution.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Tanium) · only source for this CVE.
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an unauthorized code execution vulnerability in Connect.
Executive ViewAI
Tanium Connect (CVE-2026-9208) contains a remote code execution vulnerability that allows low-privilege authenticated users to execute arbitrary commands and achieve full system compromise. Organizations using Tanium Connect face elevated operational risk, as internal users or accounts with compromised credentials can bypass application controls to achieve complete confidentiality, integrity, and availability violations with minimal technical barriers.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Apply principle of least privilege to authenticated access-revoke unnecessary user accounts and restrict permissions to minimum required roles; (2) Implement network segmentation between Tanium-managed systems and critical assets; (3) Enable comprehensive audit logging for all Connect authentication and command execution; (4) Deploy host-based intrusion detection to flag suspicious process execution; (5) Consider temporary suspension of non-essential Tanium Connect features until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance. [CVSS 7.8 HIGH]
Exploit-DB