Tanium Provision EUVD-2026-111257

Exploitation requires network reachability to a Tanium Provision instance running an affected version (Provision 1.17 before 1.17.150, 1.23 before 1.23.161, or 1.24 before 1.24.199); per CVSS PR:N/UI:N the attacker needs no authentication and no user interaction against such an instance. The precise configuration or request that triggers the denial of service is not described in the available sources. The principal limiting factor is exposure: Provision is a specialized provisioning component, so realistic risk hinges on whether its network service is reachable by untrusted networks rather than confined to a management segment; impact is limited to availability (service disruption), with no confidentiality or integrity consequence. The vendor patch is the stated remediation.

Signals are moderate and internally consistent but sparse. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) describes a network-reachable, low-complexity, unauthenticated condition with availability-only impact - a classic remote denial-of-service profile with no confidentiality or integrity loss. The vuln.today decision label is 'this_week' rather than act_now or emergency, which fits a serviceable but non-critical issue. There is no CISA KEV listing and no EPSS score in the provided data, so active-exploitation likelihood cannot be quantified; exploitation status is therefore 'no public exploit identified at time of analysis.' CWE-690 (unchecked return value, commonly leading to a null-pointer dereference or crash) is consistent with a DoS outcome, but the vendor description does not state the trigger mechanism, so the specific flaw path is not described in the available sources. Net assessment: this is a legitimate patch-this-week availability issue, not a confidentiality/integrity breach and not a confirmed emergency - the HIGH score is driven entirely by the A:H availability metric, so real-world urgency depends on how exposed and business-critical the affected Provision instances are.

A remote, unauthenticated attacker with network access to a Tanium Provision service sends traffic that triggers the flaw and crashes or hangs the service, interrupting OS-provisioning operations. No public exploit code has been identified at the time of analysis, and the exact trigger is not described in the vendor advisory. Low attack complexity (AC:L) means that once the triggering condition is known, repeated exploitation to sustain the outage is straightforward.