Tanium Reputation EUVD-2026-111265

Exploitation requires the sensitive data to actually be written to a Tanium Reputation log file and the attacker to have access to read those logs; per the CVSS vector, high privileges (PR:H) are required and attack complexity is high (AC:H), meaning conditions outside the attacker's direct control must be met. The description does not specify which feature, configuration, or log channel exposes the data, so the exact trigger is not described in the available sources. Limiting factors: the attacker must already be authenticated at a high privilege level, and the high-complexity rating further constrains reliable exploitation; affected deployments are those running Reputation 6.6 before 6.6.145, 6.7 before 6.7.138, or 6.8 before 6.8.162.

This is a moderate-severity information disclosure flaw (CWE-532, sensitive data written to a log file) in Tanium Reputation, carrying a vendor/aggregator CVSS of 6.6. The supplied vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H signals that exploitation requires high privileges (PR:H) and has high attack complexity (AC:H), which materially lowers real-world urgency even though the attack vector is network (AV:N). The signals are internally inconsistent with the weakness class: a log-file insertion issue almost always produces a confidentiality impact only, yet the vector asserts C:H/I:H/A:H - the integrity and availability impacts are not explained by anything in the description and should be verified against the Tanium advisory TAN-2026-067. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, and the vuln.today decision label is 'this_month' (not act_now/emergency), so all decision signals point to a routine, non-urgent patch rather than an active-exploitation priority. In short: a genuine issue worth remediating on a normal maintenance cycle, not a high-CVSS item masquerading as a low-risk one, but also not an emergency - the PR:H/AC:H gating and absence of any exploitation evidence keep real-world risk contained.

An attacker who already holds high-privileged access to a Tanium Reputation deployment reads application or diagnostic log files and recovers sensitive information (such as credentials, tokens, or other secrets) that the product improperly wrote to those logs. The CVSS vector's AC:H and PR:H indicate this is not a trivial drive-by: it requires existing privileged access plus conditions the attacker does not fully control. No public exploit or PoC was identified at the time of analysis.