Tanium Threat Response EUVD-2026-111237

Per the supplied CVSS vector, exploitation requires high privileges (PR:H) within Tanium Threat Response, required user interaction (UI:R), and succeeds only under high-complexity conditions (AC:H); impact is limited to confidentiality (C:H, I:N/A:N). The specific feature, action, or configuration that causes sensitive data to be written to the log is NOT described in the available sources - the description only states that sensitive information is inserted into a log file (CWE-532). Realistic exploitation additionally depends on the attacker (or a downstream reader) being able to access the affected log files, which the sources do not characterize. Limiting factors: the need for pre-existing high privileges, required user interaction, and high attack complexity substantially narrow the practical attack surface. Affected deployments are Threat Response 4.17 (<4.17.327), 4.12 (<4.12.349), and 4.9 (<4.9.476); updating to those fixed versions is the vendor remediation.

This is a low-to-moderate priority issue, not an emergency, consistent with the vuln.today 'this_month' decision label and the CVSS base score of 4.2 (MEDIUM). The supplied CVSS:3.1 vector (AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) combines high confidentiality impact with several strong limiting factors: high attack complexity, high privileges required, and required user interaction. No EPSS score was provided, there is no CISA KEV listing, and no public exploit or PoC reference appears in the input - so by the precision rules this is 'no public exploit identified at time of analysis.' A notable tension exists in the data: the vulnerability is CWE-532 (insertion of sensitive information into a log file), a class whose real-world exploitation almost always requires access to read the resulting log files (typically local or log-pipeline access), yet the vendor-supplied vector asserts AV:N. The network attack vector combined with PR:H and UI:R is internally unusual for a logging-disclosure flaw and should be verified with Tanium - the practical exposure is likely narrower than AV:N implies. Overall: a genuine confidentiality concern for already-privileged contexts, but the combination of AC:H, PR:H, UI:R, no known exploitation, and a 'this_month' label argues against treating it as urgent.

An actor with high privileges in a Tanium Threat Response deployment causes sensitive information to be written into log files, which is then disclosed to a party able to read those logs; the vendor vector indicates the path also requires user interaction and has high complexity. No public exploit or PoC was identified in the available data, and there is no evidence of active exploitation.