Tanium Threat Response EUVD-2026-116557

Exploitation requires network reachability to Tanium Threat Response plus valid low-privilege authentication (CVSS PR:L), and succeeds only under a high-complexity condition (AC:H) that the vendor advisory does not describe - the specific vulnerable feature, protocol, or configuration is not stated in the available sources. The command-injection trigger path (CWE-78) is not detailed. Limiting factors beyond raw CVSS: the attacker must already possess credentials to the Threat Response console/API, and the AC:H rating implies a non-trivial precondition, both of which reduce realistic exploitability below what the 7.5 network-vector score alone suggests. Confirm affected deployment modes and versions against TAN-2026-095.

Signals are mixed and point to a moderate, not emergency, priority. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes a network-reachable but high-complexity flaw that requires low-privileged authentication (PR:L) and yields full confidentiality, integrity and availability loss consistent with CWE-78 OS command injection leading to code execution. The vuln.today decision label is 'this_week', below act_now/emergency, so this should be scheduled rather than treated as a fire drill. There is no CISA KEV listing and no EPSS probability was supplied, so exploitation likelihood cannot be quantified from the input; the only reference is the vendor advisory (TAN-2026-095), which is not verified working exploit code - no public exploit is identified at time of analysis. The vulnerability was self-reported by Tanium rather than discovered through observed attacks. Note the tension between AV:N and AC:H/PR:L: the flaw is remotely reachable but requires both valid low-privilege credentials and a high-complexity condition that the advisory does not describe, which materially narrows the realistic attacker population. EPSS and KEV data are absent (not conflicting), and the precise trigger is undisclosed - verify affected and fixed versions directly against the Tanium advisory.

An attacker who already holds low-privilege authenticated access to a Tanium Threat Response deployment supplies crafted input that is passed to an OS command (CWE-78), achieving unauthorized code execution on the affected system. The CVSS AC:H rating indicates the attack is not trivially repeatable and depends on a condition the vendor does not detail. No public exploit code has been identified at time of analysis; the only reference is the vendor advisory.