Tanium Server EUVD-2026-111269

Exploitation requires an actor who already holds high-privilege (administrative-level) access to the Tanium Server, per PR:H in the CVSS vector; it is not reachable by an unauthenticated or low-privileged user. No user interaction is required (UI:N) and no non-default configuration is cited in the available sources. The limiting factor is the privilege prerequisite: the flaw affects the completeness/integrity of logging (CWE-778) and does not itself grant access, expose data, or affect availability, so it is only relevant where a privileged account is already in play. The specific feature or action whose logging is insufficient is not described in the available sources. Affected versions are Tanium Server branches 7.7.3 (before 7.7.3.8351), 7.8.2 (before 7.8.2.1263), and 7.8.4 (before 7.8.4.1399).

This is a low-severity, low-priority issue whose signals are internally consistent - it is not a high-CVSS alarm in disguise, but genuinely minor. The CVSS base score is 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N): network-reachable and low-complexity, but requiring high privileges (PR:H) and producing only a low integrity impact with no confidentiality or availability impact. That impact profile matches the underlying weakness, CWE-778 (insufficient logging): the flaw degrades the completeness/integrity of audit records rather than exposing or destroying data. The vuln.today decision label is 'monitor,' the lowest actionable tier, which aligns with the metrics. No EPSS score was supplied, the CVE is not on CISA KEV, and no PoC or exploit reference is present, so there is no public exploit identified at time of analysis. The one tension worth noting is the 'Information Disclosure' tag, which does not fit an insufficient-logging weakness with C:N (no confidentiality impact) - treat that tag as suspect rather than as evidence of data exposure. Overall this is a defense-in-depth/auditability gap exploitable only by an already-privileged actor, appropriately handled by routine patching rather than emergency response.

An actor who already holds high-privilege access to the Tanium Server performs administrative actions that are not adequately recorded, reducing the audit trail available to defenders and incident responders. Because exploitation requires existing privileged access (PR:H) and yields only a low integrity impact with no data exposure, the practical effect is weakened accountability rather than direct compromise. No public exploit identified at time of analysis.