Tanium Threat Response EUVD-2026-111260

Exploitation requires local access to the endpoint running the Tanium Threat Response Client Extension (Endpoint Configuration Toolset Solution / threat-response-cx) with at least low-level authenticated privileges (AV:L, PR:L), plus satisfying an unspecified high-complexity condition (AC:H) that the available sources do not describe - do not assume it is a race or timing window without evidence. No remote or network exploitation is possible, and no user interaction is required (UI:N). The flaw is an improper link-resolution (CWE-59) issue, so exploitation depends on the attacker being able to create or influence a symbolic link in a filesystem location the extension accesses; the sources do not enumerate the exact feature, path, or configuration involved. Limiting factors: local-only vector, required pre-existing low privileges, and the AC:H condition all narrow realistic exploitation to attackers already present on the host.

This is a moderate-severity, locally-exploitable issue rather than an urgent remote threat. The CVSS 6.3 vector (AV:L/AC:H/PR:L/UI:N) confirms the attacker must already have local access to the host with at least low (PR:L, authenticated) privileges, and must overcome a high attack complexity (AC:H) condition - the vector signals severity, not mechanism, and the available sources do not describe what that condition is. Impact is meaningful once triggered: high confidentiality and integrity (C:H/I:H) with no availability impact (A:N), consistent with a CWE-59 symlink/link-resolution flaw that lets a local user read or overwrite files the Threat Response client extension touches with its own privileges. No EPSS score, CISA KEV listing, or public exploit was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the issue was reported by the vendor (Tanium) itself rather than observed in attacks. The vuln.today decision label is 'this_month', aligning with a patch-on-normal-cycle priority rather than emergency. Net: a legitimate but not top-tier priority - the local-only vector and AC:H substantially limit real-world exploitability, offset by the high C/I impact and the fact that the affected agent typically runs with elevated privileges on managed endpoints.

A local, low-privileged user on a managed endpoint plants a crafted symbolic link in a path the Tanium Threat Response client extension accesses; when the extension resolves the link during a file operation, it is redirected to a file outside its intended scope, letting the attacker read sensitive data or overwrite a protected file using the extension's privileges. The high attack complexity means the attacker must satisfy an additional, source-undescribed condition for the link to be followed at the right moment. No public exploit identified at time of analysis.