Tanium Discover EUVD-2026-116550

Exploitation requires an authenticated Discover account with low privileges (PR:L) sufficient to place attacker-controlled content into a field that Discover renders into exported/generated output, AND a second user who exports and opens that output in a downstream application that interprets formula elements (UI:R). Limiting factors: it is not remote-unauthenticated - the attacker needs valid credentials, the payload only acts when a victim opens the generated output, and the confirmed impact is restricted to low availability (C:N/I:N/A:L), so it is not a direct data-disclosure or code-execution primitive against Discover itself. The description does not name the specific Discover feature or output format affected, so the exact vulnerable export path should be confirmed with Tanium.

This is a genuinely low-priority issue by most signals, not a high-CVSS scare. The vendor CVSS base score is only 4.1 (medium-low). The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L indicates an authenticated attacker (PR:L) who needs victim interaction (UI:R), with the only measured impact being low availability (A:L) and no confidentiality or integrity impact (C:N/I:N). The scope-changed flag (S:C) is consistent with CWE-1236 (improper neutralization of formula elements in output, i.e. CSV/formula injection), where injected content executes in a downstream consumer such as a spreadsheet application rather than in Discover itself. No EPSS probability was supplied, there is no CISA KEV listing, and no proof-of-concept or exploit reference is present (the sole reference is the Tanium advisory). The vuln.today decision label is 'this_month', i.e. routine scheduled patching, not act_now or emergency. Note a signal conflict worth flagging: the input Tags include 'Information Disclosure', yet the CVSS vector sets C:N (no confidentiality impact) and the CWE points to formula/output injection rather than data disclosure - verify the actual impact with Tanium rather than treating this as a confidentiality issue.

An authenticated low-privilege Tanium user injects unsanitized content (e.g. a formula element) into a field that Discover later includes in generated output; when another user exports and opens that output in an external application, the injected element is interpreted rather than displayed as text. No public exploit or PoC was identified, and exploitation requires that second user to open the crafted output (UI:R), limiting real-world reach.