Tanium End-User CX EUVD-2026-111262

Requires existing local, authenticated access with low privileges (AV:L, PR:L) on a host running an affected Tanium End-User-CX or Endpoint Configuration Toolset Solution version; no user interaction is needed (UI:N). The weakness is classified as CWE-59 (link following), but the available sources do not describe the specific feature, file, or symlink condition that triggers it, so the exact prerequisite configuration is not confirmed. Limiting factors: the attacker must already have a foothold on the endpoint (no remote/network path), and the affected software is enterprise agent software rather than internet-facing, which constrains realistic exploitation to post-compromise scenarios.

The signals converge on a genuine but non-emergency priority. The CVSS base score of 7.8 is driven entirely by high confidentiality, integrity and availability impact (C:H/I:H/A:H) on an unchanged scope, not by ease of reach: the vector is local (AV:L) and requires existing low privileges (PR:L), so this is a privilege-escalation primitive for an attacker who already has a foothold, not a remote entry point. No EPSS score was supplied, the CVE is not on the CISA KEV list, and no public exploit or PoC reference is present - only a vendor advisory - so there is no evidence of active or imminent mass exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a locally-exploitable, vendor-reported, already-patched flaw. CWE-59 (link following) is listed as the weakness class, but the description is a single sentence and does not state how the flaw is triggered, so the exact mechanism is not confirmed from the available sources. Net: patch on the vendor's 'this_week' cadence; treat as a post-compromise escalation risk rather than a widespread external threat.

An attacker who already has a low-privileged account or code-execution foothold on a managed endpoint running Tanium End-User-CX / Endpoint Configuration Toolset abuses the End-User Notifications component to escalate to higher (likely SYSTEM/root-level) privileges on that host. Exploitation is local and needs no user interaction (AV:L/UI:N), but it does require the attacker to first be present on the machine. No public exploit code or PoC reference is identified at time of analysis.