EUVD-2026-116555Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitSend request to Discover
-
ExecutionTrigger information disclosure
-
ImpactRead unauthorized data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privileged account on the Tanium Discover application (CVSS PR:L), reachable over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). The specific product feature, configuration, or request that triggers the disclosure is not described in the available sources. The principal limiting factor is the authentication requirement - an unauthenticated outsider cannot exploit this; the attacker must first obtain valid Discover credentials, and the impact is confined to limited confidentiality loss (C:L) with no integrity or availability effect. |
| Impact | This is a moderate-severity information disclosure issue (CVSS 4.3) that signals low real-world priority rather than an emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N indicates a network-reachable, low-complexity flaw but one that requires an already-authenticated low-privileged user (PR:L), with only limited confidentiality impact and no integrity or availability impact (C:L/I:N/A:N). There is no CISA KEV listing and no EPSS score supplied, so there is no quantitative exploitation-probability signal; absence of these is not evidence either way. The vuln.today decision label is 'this_month', consistent with a patch-on-normal-cycle item rather than act_now or emergency. The sole reference is the Tanium vendor advisory (TAN-2026-093), not a proof-of-concept, so there is no public exploit identified at time of analysis. The main limiting factor is the authentication requirement: an attacker must already hold valid low-privilege access to the Discover instance, which substantially narrows the threat population compared to an unauthenticated flaw. |
| Exploit ScenarioDerived | An attacker who already holds low-privileged authenticated access to a Tanium Discover instance leverages the flaw to read information they should not be able to see. The exact trigger is not described in the available sources, and no public exploit code has been identified; exploitation is network-reachable but gated behind valid credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Information disclosure in Tanium Discover lets an authenticated low-privileged user retrieve limited confidential data over the network without user interaction. The flaw carries a CVSS score of 4.3 and is rated this_month in priority; no public exploit was identified at time of analysis. The specific Discover feature, configuration, or request that triggers the exposure is not described in the available sources, and impact is confined to confidentiality with no integrity or availability effect.
RemediationAI
Tanium addressed the issue, and the vendor advisory TAN-2026-093 at https://security.tanium.com/TAN-2026-093 should be used to identify the fixed release; the supplied data does not include an exact fixed version number, so confirm the appropriate build before upgrading. Because exploitation requires a valid low-privileged Discover account (PR:L), restricting Discover access to authorized users and reviewing existing accounts limits exposure; this does not remove the need to apply the vendor update. No public exploit code or PoC was identified at time of analysis, and the issue is rated this_month rather than act_now.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the root-cause class: the product fails to adequately protect data from a party that should not see it. The CPE cpe:2.3:a:tanium:discover:*:*:*:*:*:*:*:* identifies Tanium Discover as the affected component with no version constraint supplied, so all versions are potentially in scope. Per the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, the attacker must hold a valid low-privileged Discover account, can reach the service over the network, and needs no user interaction; the result is limited confidentiality loss only. The evidence does not state which Discover endpoint, report, query, or configuration path triggers the exposure, so the exact mechanism is not confirmed.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Authenticated network access needed (PR:L, AV:N); information disclosure yields limited confidentiality impact only (C:L), with no integrity or availability effect.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an information disclosure vulnerability in Discover.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
GitHub PoC
Exploit-DB