Tanium Data Service EUVD-2026-116548

Exploitation requires the attacker to already hold high privileges (PR:H) on the Tanium platform and to reach the Tanium Data Service over the network (AV:N); the high attack complexity (AC:H) indicates conditions beyond the attacker's sole control must be met, though the available sources do not describe what those conditions are. The affected components are Tanium Data Service and Tanium Interact. No user interaction is required (UI:N). The limiting factors - a high-privilege prerequisite and high complexity - mean this is realistically exploitable only by an already-privileged user or a post-authentication attacker, not by an unauthenticated remote actor. The exact product feature, protocol, or configuration that triggers the path traversal is not described in the available sources.

This is a moderate-severity, low-urgency issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L, base 5.0) describes a network-reachable but high-complexity flaw that requires high privileges (PR:H) to exploit, with integrity as the primary impact (I:H) and only low availability impact (A:L) and no confidentiality impact (C:N). The high privilege requirement and high attack complexity substantially constrain real-world exploitability: an attacker already needs elevated access to the Tanium platform before this path traversal becomes useful. No EPSS score was provided in the input, there is no CISA KEV listing, and no proof-of-concept or exploit reference is present - only the vendor advisory. The vuln.today decision label is 'this_month,' consistent with a non-emergency, schedule-it-into-the-patch-cycle priority rather than act-now. One tension worth flagging: CWE-22 path traversal often yields file disclosure (confidentiality), yet the supplied vector sets C:N and I:H, implying the traversal is used to write/overwrite rather than read files - the terse description does not confirm the mechanism, so verify the actual impact with the Tanium advisory (TAN-2026-082).

An attacker who already holds high-privilege access to a Tanium deployment supplies a crafted path to the Tanium Data Service, abusing insufficient path sanitization (CWE-22) to reach files outside the intended directory and tamper with their contents. Because exploitation requires high privileges and high attack complexity, this is a realistic post-compromise or malicious-insider escalation path rather than an opportunistic remote attack. No public exploit identified at time of analysis.