What is the CVSS score of EUVD-2026-32034?

EUVD-2026-32034 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tanium Server are affected by EUVD-2026-32034?

Tanium Server versions 7.6-7.8 are vulnerable to a remote denial-of-service attack that can render the endpoint-management console unavailable, temporarily blocking your security operations team from…. A patch is available.

How to fix or mitigate EUVD-2026-32034?

Within 24 hours: identify and inventory all Tanium Server instances, prioritizing versions 7.6, 7.7, and 7.8. Within 7 days: obtain vendor patches from the Tanium advisory (specific patch version per branch) and deploy to all affected instances, prioritizing production environments that support critical security operations. Within 30 days: confirm patch deployment via asset inventory, establish monitoring for anomalous resource consumption on Tanium endpoints, and log remediation completion.

Tanium Server EUVD-2026-32034

| CVE-2026-9156 HIGH

Missing Release of Resource after Effective Lifetime (CWE-772)

2026-05-27 3938794e-25f5-4123-a1ba-5cbd7f104512

GHSA-8987-p6rf-jvmc

Denial Of Service Server Tanium

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-facing resource-leak DoS exploitable without auth or interaction, so AV:N/AC:L/PR:N/UI:N; availability-only impact gives A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 11:39 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 11:22 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 11:22 NVD

MEDIUM HIGH

CVSS changed

Jul 23, 2026 - 11:22 NVD

6.5 (MEDIUM) 7.5 (HIGH)

Analysis Generated

May 27, 2026 - 21:41 vuln.today

Patch available

May 27, 2026 - 19:46 EUVD

DescriptionNVD

Tanium addressed a denial of service vulnerability in Tanium Server.

AnalysisAI

Denial of service in Tanium Server allows remote unauthenticated attackers to exhaust resources and render the endpoint-management console unavailable, disrupting security operations across managed fleets. Rooted in a missing resource release (CWE-772), the flaw carries a 7.5 CVSS driven purely by availability impact, with no confidentiality or integrity effect; there is no public exploit identified at time of analysis and EPSS probability is negligible at 0.03%. A vendor patch is available across the 7.6, 7.7, and 7.8 branches.

Technical ContextAI

Tanium Server is the central control plane of the Tanium endpoint-management and security platform, coordinating agents, question/action distribution, and console access across large enterprise fleets. The weakness is classified as CWE-772 (Missing Release of Resource after Effective Lifetime), meaning the server fails to free an allocated resource - such as memory, file handles, connections, or threads - after it is no longer needed. Repeated triggering of the affected code path over the network causes cumulative resource exhaustion, eventually degrading or halting the server. The three CPE entries (cpe:2.3:a:tanium:server) all reference the Tanium Server application; the EUVD data pins the affected branches to the 7.6.4.x, 7.7.3.x, and 7.8.2.x version families.

RemediationAI

Vendor-released patch: upgrade Tanium Server to at least 7.6.4.2190 (for 7.6.4.x), 7.7.3.8274 (for 7.7.3.x), or 7.8.2.1176 (for 7.8.2.x), matching the fixed build to your deployed branch, per the vendor advisory at https://security.tanium.com/TAN-2026-013. As compensating controls until patching, restrict network reachability of the Tanium Server management interfaces to trusted administrative networks or VPN segments and place them behind a firewall or reverse proxy that can rate-limit or filter the exposed service, since AV:N exploitation depends on network access to the server; the trade-off is that overly aggressive filtering could impede legitimate console or agent connectivity, so validate rules against normal Tanium traffic patterns before enforcing. Because impact is availability-only, prioritize monitoring server resource utilization (memory, handles, connections) to detect exhaustion attempts as an interim detective control.