Tanium Threat Response EUVD-2026-81084

Exploitation requires valid authenticated access to Tanium Threat Response at a low privilege level (CVSS PR:L) - the attacker must already have a working account or API credentials to the console. Given AV:N/AC:L/UI:N, once authenticated the attacker can trigger the SQL injection remotely over the network with low complexity and no user interaction, against a network-exposed Threat Response instance. The primary limiting factors are the authentication requirement and the need for network reachability to the management interface; the exact injectable feature/parameter is not disclosed in the available data (see vendor advisory TAN-2026-047).

The vendor CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-reachable, low-complexity SQL injection that requires only low-level authentication (PR:L) and no user interaction, yielding full confidentiality, integrity and availability impact on the affected component. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no evidence of active exploitation or automated weaponization at this time - the risk is currently theoretical/potential rather than observed. The high score is driven largely by the classic SQLi impact triad (C:H/I:H/A:H is typical for database-access injection) combined with the PR:L authentication requirement, which is a meaningful limiter: an attacker must already possess valid (even low-privileged) credentials to a Tanium Threat Response console/API. The description is extremely sparse ('Tanium addressed a SQL injection vulnerability in Threat Response') and provides no detail on the injectable parameter, endpoint, or whether A:H reflects genuine DoS or is boilerplate - this should be verified against the vendor advisory TAN-2026-047. Net: a real patch-priority issue for organizations running Threat Response given remote network vector and full impact, but the authentication requirement and absence of exploitation signals place it below unauthenticated-RCE urgency.

An attacker holding valid low-privileged credentials to a Tanium Threat Response console or API submits a crafted request containing malicious SQL in a user-controlled parameter, which is concatenated into a backend query. The injection lets them read, modify, or destroy data in the underlying database, potentially disclosing threat/incident data or escalating within the platform. No public exploit code is identified at time of analysis, and exploitation requires prior authenticated access.