Tanium Threat Response EUVD-2026-111261

Exploitation requires pre-existing low-privilege authenticated access to the Tanium Threat Response component (CVSS PR:L), after which a network-delivered request can trigger the command injection without any user interaction (AV:N, UI:N, AC:L). The specific product feature, API, or input field that carries the injectable command is not described in the available sources, so the exact trigger is unverified. The limiting factor is the required authentication/privilege level on Threat Response - this is not a fully unauthenticated flaw - which confines realistic exploitation to actors who already have some foothold or valid low-privilege credentials in the Tanium environment. Affected versions are Threat Response 4.17 before 4.17.327, 4.12 before 4.12.349, and 4.9 before 4.9.476; updating to those fixed builds is the vendor-provided remedy.

This is a credible near-term priority rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity, authenticated flaw with no user interaction and full confidentiality/integrity/availability impact (C:H/I:H/A:H), consistent with the CWE-77 command injection and the RCE/Command Injection tags. The vuln.today decision label is 'this_week', which signals prompt remediation but not emergency. Key signals are MISSING or weak: there is no EPSS exploitation-probability score in the input, the CVE is NOT on CISA KEV, and no proof-of-concept or exploit reference is present (the only references are the vendor advisory and the NVD detail page). So exploitation likelihood is unquantified - the elevated concern rests on the severe technical impact and low attack complexity, not on observed activity. The main mitigating factor is PR:L: the attacker must already hold some authenticated/low-privilege access to the Threat Response component, which narrows the exposed population to environments where that access is reachable. The description is terse ('addressed an unauthorized code execution vulnerability') and does not state the trigger mechanism, so the exact injection path is unverified from available sources.

An attacker who already holds low-privilege authenticated access to Tanium Threat Response sends crafted input to the vulnerable component; because of the command-injection flaw (CWE-77), that input is passed into a system/command context and executed, yielding code execution with full impact to confidentiality, integrity, and availability. No user interaction is required (UI:N) and attack complexity is low (AC:L). No public exploit code or PoC reference is present in the provided data.