What is the CVSS score of CVE-2026-9208?

CVE-2026-9208 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Tanium Connect are affected by CVE-2026-9208?

Tanium Connect (CVE-2026-9208) contains a remote code execution vulnerability that allows low-privilege authenticated users to execute arbitrary commands and achieve full system compromise.. A patch is available.

How to fix or mitigate CVE-2026-9208?

24 hours: Inventory all systems running Tanium Connect; document current versions and user access levels; restrict Connect access to only essential personnel. 7 days: Implement network segmentation to isolate Tanium-managed endpoints; enable audit logging on all Connect administrative and command activities. 30 days: Monitor Tanium vendor advisories for patch release timeline; prepare and stage upgrade testing for patched version when available.

Tanium Connect CVE-2026-9208

EUVD-2026-32667 HIGH

OS Command Injection (CWE-78)

2026-05-27 Tanium

GHSA-2qj8-f68j-jw3x

Command Injection RCE Connect

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 27, 2026 - 23:03 EUVD

Analysis Generated

May 27, 2026 - 22:01 vuln.today

DescriptionCVE.org

Tanium addressed an unauthorized code execution vulnerability in Connect.

AnalysisAI

Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run arbitrary commands on the host, achieving full compromise of confidentiality, integrity, and availability. The CVSS 8.8 (network vector, low complexity, low privileges, no user interaction) reflects an authenticated remote code execution issue rooted in command injection (CWE-78). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

Tanium Connect is the data-export/integration module of the Tanium endpoint management platform, used to forward endpoint and inventory data to external destinations (SIEMs, databases, files, HTTP endpoints). The affected component is identified by CPE cpe:2.3:a:tanium:connect (all versions enumerated). The root-cause class is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning attacker-controlled input reaches an operating-system command interpreter without adequate sanitization, allowing injected commands to execute in the context of the Connect process. The vendor and tags (RCE, Command Injection) corroborate that this is an OS command-injection path leading to code execution.

RemediationAI

Patch available per vendor advisory - apply the fixed Tanium Connect release described in Tanium security advisory TAN-2026-015 (https://security.tanium.com/TAN-2026-015); the exact fixed version was not in the provided data and must be obtained from that advisory. Until patching is complete, reduce exposure by tightening who can authenticate to and configure Connect (the attack requires low-privilege access, so restricting Connect console/configuration permissions to a minimal set of trusted administrators directly limits the attack surface, at the cost of operational flexibility for integration owners), restricting network reachability of the Connect/Tanium server management interfaces to trusted administrative networks, and auditing Connect destination/configuration objects for anomalous or injected command content. Confirm any workaround against TAN-2026-015, as vendor guidance may supersede these compensating controls.