Tanium
Monthly
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauthorized code on the affected module. Certificate Manager 1.17 before 1.17.417, 1.18 before 1.18.368, and 1.22 before 1.22.119 are affected; the vendor has released fixed builds and vuln.today assigns this_week priority. No public exploit identified at time of analysis.
Uncontrolled resource consumption in Tanium Enforce allows remote attackers to degrade or exhaust service availability across the 2.9, 2.10, and 3.0 branches, rated CVSS 7.5 with availability-only impact (C:N/I:N/A:H). The assessed vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity attack requiring no privileges or user interaction, though the vendor description does not name the specific feature, protocol, or request type that triggers the exhaustion, and practical exposure is bounded by network reachability of an endpoint-management console normally deployed inside a managed enterprise perimeter. Vendor patches are available in Enforce 2.9.736, 2.10.778, and 3.0.373; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or KEV data was supplied.
Local privilege escalation in Tanium End-User CX and the Tanium Endpoint Configuration Toolset Solution lets a user who is already logged on with low privileges raise their rights to a high-impact level (C:H/I:H/A:H) on the affected endpoint, with no user interaction required. Affected builds are end-user-cx releases up to 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 and 1.24.590, plus Endpoint Configuration Toolset Solution 1.51.60, 1.59.50 and 1.71.25; Tanium has released fixes for these branches. No public exploit was identified at time of analysis, and the weakness is classified as CWE-59 link following, although the sources do not describe the precise file or link condition that triggers it. The realistic exposure is a post-compromise scenario on an enterprise agent endpoint rather than a network-facing attack, which is why the priority is 'this_week' rather than emergency action.
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code remotely, with high confidentiality, integrity, and availability impact (CVSS 8.8; AV:N/AC:L/PR:L/UI:N). Affected branches are 4.17 before 4.17.327, 4.12 before 4.12.349, and 4.9 before 4.9.476, and the vendor has released fixed builds. No public exploit identified at time of analysis; active exploitation is not confirmed in the provided sources, and the vuln.today priority is this_week, reflecting a credible near-term priority rather than an inflated high-CVSS score.
Local privilege escalation in Tanium End-User CX and the Endpoint Configuration Toolset Solution allows an authenticated low-privileged user with local access to a managed endpoint to gain high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). The flaw is in the End-User Notifications component and is classified as CWE-59 link following; Tanium reports a vendor patch in advisory TAN-2026-058. This is a credible but non-emergency issue: no public exploit identified at time of analysis, no CISA KEV active-exploitation signal is present in the supplied data, and exploitation requires an existing local foothold.
Denial of service in Tanium Provision allows unauthenticated remote attackers to degrade availability of affected Provision instances - 1.17 before 1.17.150, 1.23 before 1.23.161 and 1.24 before 1.24.199 - with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so confidentiality and integrity are unaffected. Tanium has released fixed builds (1.17.150, 1.23.161 and 1.24.199); no public exploit was identified at time of analysis and the issue is not in CISA KEV. Priority is this_week: the practical risk hinges on whether the Provision service is reachable from untrusted networks or confined to a management segment.
Improper output sanitization in Tanium Enforce 2.9, 2.10, and 3.0 allows a network-reachable attacker to craft malicious output that can lead to limited information disclosure and integrity impact when a legitimate user views or exports affected data (CVSS 7.1). The CVSS vector indicates no required privileges (PR:N) but user interaction (UI:R) is required, and whether injecting the payload itself requires prior authenticated access to Enforce is unverified; no public exploit identified at time of analysis. Tanium has released fixed builds in Enforce 2.9.736, 2.10.778, and 3.0.373, and the vuln.today priority engine rates remediation as 'this_week'.
Improper output sanitization in Tanium Comply allows a remote, unauthenticated attacker to introduce crafted content that is rendered or exported when an authorized operator views the affected output, with the scope change indicating impact beyond the attacker-controlled component, such as the operator's session or an exported file. Only Comply 2.32 before 2.32.263, 2.35 before 2.35.323, and 2.37 before 2.37.326 are affected; confidentiality, integrity, and availability impacts are Low, and the required user interaction is the main limiting factor. No public exploit was identified at the time of analysis, and patched builds are available from Tanium.
A heap-based buffer overflow in Tanium's Index component (index-cx), also shipped within the Endpoint Configuration Toolset Solution, allows an attacker who already holds local access and low-level privileges on an endpoint to corrupt heap memory, with the potential for code execution at the integrity level of the affected Index process (CVSS 3.1: 7.8, AV:L/PR:L/AC:L, C/I/A all High, Scope Unchanged). Only hosts running the affected index-cx builds (3.9.x, 3.11.x, 3.14.x, 3.15.x, 3.16.x) or Endpoint Configuration Toolset Solution 1.51, 1.59 and 1.71 branches are exposed; the flaw is not reachable remotely or without credentials per the assessed vector. No public exploit code has been identified at time of analysis and there is no KEV listing, but Tanium has released fixed builds and the issue is prioritized for remediation this week.
Denial of service in Tanium Enforce (3.0 before 3.0.373, 2.10 before 2.10.778, and 2.9 before 2.9.736) lets remote attackers consume resources by getting a highly compressed payload into a decompression path, a compression bomb (CWE-409) carrying an availability-only impact and a 7.5 severity score. Fixed builds are published by the vendor, and no public exploit code has been identified at time of analysis. The precise feature or input that performs the decompression is not described in the available sources, so the practical precondition remains the affected version plus the ability to deliver a crafted payload to that path.
Local privilege escalation in Tanium End-User CX (end-user-cx) and the Tanium Endpoint Configuration Toolset Solution lets an attacker who already holds a low-privileged local account on a managed endpoint leverage a link-following flaw (CWE-59) to gain high-integrity code execution, with CVSS 3.1 scoring 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only hosts running the pre-fix builds are exposed - end-user-cx below 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 or 1.24.590, and Endpoint Configuration Toolset Solution below 1.51.60, 1.59.50 or 1.71.25. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor has released fixed builds, and the practical exposure is limited to endpoints that are already multi-user or already partially compromised.
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-privileged, authenticated user to inject crafted input over the network and manipulate the backend SQL queries, producing high confidentiality, integrity and availability impact on the affected component. Exploitation requires a valid Threat Response console account or API credentials at low privilege (PR:L) plus network reachability to the management interface, but needs no user interaction and involves low attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis; Tanium addressed the issue and documents it in advisory TAN-2026-047.
SQL injection in the Tanium Asset module lets a high-privilege authenticated console user execute arbitrary SQL against the Asset data store, with the potential to read, modify, or destroy data the module manages (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The flaw is remotely reachable and requires no user interaction, but it is gated on two conditions: the optional Asset module must be deployed, and the attacker must already hold an elevated Tanium console session - a self-service or low-privilege account is insufficient. Affected builds are Asset before 1.33.326, before 1.36.174, and before 1.39.153; Tanium has released fixed versions and there is currently no public exploit identified at time of analysis, though the EPSS score is minimal and no CISA KEV listing applies.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlying Asset database, carrying a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a privileged account on the Asset module with network access to its interface and no user interaction; unauthenticated or low-privilege users cannot reach the vulnerable query path, and because Tanium is typically an internally deployed enterprise platform, realistic abuse is concentrated among insiders or attackers who have already escalated to a privileged Asset role. Publicly available exploit code exists (a public gist is referenced), but the issue is not in CISA KEV, so there is no confirmation of active exploitation in the wild. Fixed versions are available from the vendor.
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to perform unauthorized actions, producing high integrity and availability impact across the platform. Tanium disclosed this vulnerability via advisory TAN-2026-041; the CVSS 8.1 score reflects network-reachable exploitation requiring only a valid low-privilege account with no user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Server-side template injection (SSTI) in Tanium Comply enables remote code execution by a highly privileged authenticated user, yielding full confidentiality, integrity, and availability impact on the Comply server. The vulnerability (CWE-1336) results from insufficient neutralization of template directives in user-controlled input, allowing the underlying template engine to evaluate and execute injected payloads server-side. Tanium addressed this in advisory TAN-2026-040; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's intended directory scope, resulting in high confidentiality impact and scope change to the broader host system. The CVSS vector (S:C, C:H) indicates the traversal can reach resources beyond the Comply component itself, potentially exposing sensitive configuration, credentials, or endpoint compliance data accessible to the Tanium platform. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Tanium Enforce allows authenticated low-privileged users to cause the Enforce server to issue arbitrary HTTP requests to internal network resources outside the application's normal authorization boundary. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect that a successful attack can expose internal services, cloud metadata endpoints, or backend infrastructure inaccessible to the attacker directly. Tanium disclosed and addressed this issue in advisory TAN-2026-036; no public exploit code or active exploitation has been identified at time of analysis.
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user interaction and high attack complexity - to execute arbitrary SQL against the backend database, with a scope change that extends impact beyond the Comply application itself to C:H/I:H/A:H. Tanium addressed this in advisory TAN-2026-042. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Improper access controls (CWE-862 Missing Authorization) in Tanium Comply expose compliance and vulnerability assessment data to authenticated users who lack sufficient privileges to access it. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) scores this at 7.1, with high confidentiality impact and limited integrity risk, exploitable over the network by any low-privileged Tanium account holder with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write against the underlying host. The CVSS vector (AV:N/AC:L/PR:L/S:C/I:H) confirms the vulnerability is network-reachable without administrative credentials and breaks containment boundaries beyond the Comply module itself. Tanium addressed the issue under advisory TAN-2026-043; no public exploit code or CISA KEV listing is currently identified.
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations with high integrity and availability impact over the network. Exploiting this CWE-863 (Incorrect Authorization) flaw, an attacker with minimal authenticated access can bypass authorization enforcement within the Comply module, potentially altering compliance posture data or disrupting compliance workflows. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed.
OS command injection in Tanium Enforce enables a local attacker to execute arbitrary operating system commands at the privilege level of the Enforce agent process. The flaw (CWE-78) requires user interaction and specific exploitation preconditions, reflected in a CVSS 7.0 score despite full C:H/I:H/A:H impact ratings. Tanium self-disclosed the issue via advisory TAN-2026-022; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Denial of service in Tanium Server allows remote unauthenticated attackers to exhaust availability of the platform, per vendor advisory TAN-2026-016. The flaw is network-reachable with low complexity and no privileges or user interaction (CVSS 7.5, availability-only impact), and the CWE-789 classification indicates an uncontrolled/excessive memory allocation can be triggered remotely. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run arbitrary commands on the host, achieving full compromise of confidentiality, integrity, and availability. The CVSS 8.8 (network vector, low complexity, low privileges, no user interaction) reflects an authenticated remote code execution issue rooted in command injection (CWE-78). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; EPSS data was not provided.
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the underlying host, yielding full confidentiality, integrity, and availability compromise (CVSS 8.8). The flaw affects Connect branches 5.26, 5.29, and 5.37 below their respective fixed builds and is tagged as RCE/Command Injection. There is no public exploit identified at time of analysis, and EPSS estimates exploitation probability at a low 0.07% (22nd percentile).
Denial of service in Tanium Server allows remote unauthenticated attackers to exhaust resources and render the endpoint-management console unavailable, disrupting security operations across managed fleets. Rooted in a missing resource release (CWE-772), the flaw carries a 7.5 CVSS driven purely by availability impact, with no confidentiality or integrity effect; there is no public exploit identified at time of analysis and EPSS probability is negligible at 0.03%. A vendor patch is available across the 7.6, 7.7, and 7.8 branches.
Insufficient logging in Tanium Server branches 7.7.3, 7.8.2, and 7.8.4 can cause certain privileged operations to be incompletely recorded in audit logs, weakening forensic visibility and log integrity (CWE-778); the flaw requires high-privileged authenticated access (PR:H) and carries a low CVSS score of 2.7. No public exploit code has been identified at time of analysis, and Tanium has released fixed builds for all three affected branches.
Information disclosure in Tanium Server lets an authenticated low-privilege user expose limited sensitive data over the network, with no integrity or availability impact. The issue affects deployments running versions below 7.7.3.8351, 7.8.4.1399, and 7.8.2.1263, and Tanium has released fixed builds for each branch. Rated 4.3 with an AC:L/PR:L vector, it is a moderate-severity, lower-priority item - no public exploit identified at time of analysis and no CISA KEV listing.
Sensitive information disclosure in Tanium Reputation allows confidential data handled by the module to be written into Reputation log files, where a party able to read those logs can recover it. Deployments running Reputation 6.6 before 6.6.145, 6.7 before 6.7.138, or 6.8 before 6.8.162 are affected; the assessed vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) confines realistic impact to confidentiality loss for an authenticated, highly privileged party that already has log access, rather than to integrity or availability damage. No public exploit code has been identified at time of analysis, and vendor-released patches exist for all three affected branches.
An uncontrolled resource consumption flaw (CWE-770) in Tanium Enforce lets an authenticated user drive the Enforce component into resource exhaustion, degrading only the availability of that component. Deployments running Enforce 3.0 before 3.0.373, 2.9 before 2.9.736, or 2.10 before 2.10.778 are affected; patched builds are not exploitable. The CVSS score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), reflecting a low-impact, availability-only issue that requires a valid Enforce session - no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Tanium Comply builds 2.32 before 2.32.263, 2.35 before 2.35.323, and 2.37 before 2.37.326 enforce authorization incorrectly, allowing a low-privilege authenticated user with network access to read data outside their permitted scope. The flaw is rated CVSS 4.3 with confidentiality-only, low impact, and requires valid Comply credentials, so it is not exploitable without authentication; no public exploit was identified at time of analysis, and Tanium has released fixed builds.
Improper link resolution in the Tanium Threat Response Client Extension (threat-response-cx and the Endpoint Configuration Toolset Solution) allows an authenticated local attacker with low privileges to follow a manipulated link and read or write files outside the intended location, producing high confidentiality and integrity impact with no availability effect. Affected builds include threat-response-cx releases prior to 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271 and 1.21.1673, and Endpoint Configuration Toolset Solution releases prior to 1.51.60, 1.59.50 and 1.71.25. Exploitation is local-only and additionally depends on an unspecified high-complexity condition, so realistic abuse is limited to attackers who already hold a foothold on the endpoint; no public exploit code has been identified at time of analysis.
Improper access controls in Tanium Comply allow a low-privileged authenticated network user to reach functionality or data outside their intended permissions, with limited confidentiality, integrity, and availability impact and a scope change. Affected builds are Comply 2.32 before 2.32.263, 2.35 before 2.35.323, and 2.37 before 2.37.326; Tanium has released fixed builds in each branch. No public exploit has been identified at time of analysis, and the vendor's high attack-complexity rating keeps this a moderate-severity, lower-urgency issue.
Local denial of service in the Tanium Performance client extension (performance-cx) and the Tanium Endpoint Configuration Toolset Solution lets a user who already holds low-level privileges on an endpoint exhaust resources in the agent, degrading or halting its availability with no confidentiality or integrity impact. The flaw is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and requires local access to the host, so it is a moderate-severity issue rather than a top-tier priority. Tanium has released fixed builds and no public exploit was identified at time of analysis; priority is this_month.
Denial of service in Tanium Enforce allows an authenticated low-privileged user with network reachability to the Enforce component to crash the service through a null pointer dereference (CWE-476), rated CVSS 6.5 with availability impact High and no confidentiality or integrity effect. Affected deployments are Enforce 2.9 before 2.9.736, Enforce 2.10 before 2.10.778, and Enforce 3.0 before 3.0.373, and the vendor (Tanium, TAN-2026-074) has released fixed builds for each branch. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation is confined to users who already hold valid credentials on the Tanium platform.
An incorrect privilege assignment flaw (CWE-178) in Tanium Server allows a network-positioned attacker who already holds high privileges on the platform to gain full confidentiality, integrity and availability impact (C:H/I:H/A:H) by meeting a high-complexity precondition that is not detailed in the available sources. Affected releases are Tanium Server below 7.7.3.8351, below 7.8.2.1263 and below 7.8.4.1399; Tanium has published advisory TAN-2026-054 and fixed versions for each branch, so the exposure is limited to unpatched deployments. The vector requires PR:H and AC:H, meaning opportunistic or unauthenticated exploitation is infeasible from this data, and the vendor-reported severity is moderate at CVSS 6.6; no public exploit code or CISA KEV listing is present in the available intelligence, and the priority decision is 'this_month'.
Improper access controls in Tanium Enforce allow authenticated users with low privileges to read limited data they should not be able to access, with no integrity or availability impact. Enforce 2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373 are affected; CVSS 3.1 scores this 4.3 as a network-reachable, low-privilege issue requiring a valid session. No public exploit code was identified at time of analysis, and the vendor has released fixed builds.
Tanium Stream Client Extension (cx-stream) and Endpoint Configuration Toolset Solution do not properly validate certificates on the connections they initiate, so an attacker who can intercept or relay TLS traffic can impersonate the peer and disclose information (CVSS 6.5; C:H/I:N/A:L). The issue is unauthenticated (PR:N) and requires no user interaction (UI:N), but exploitation depends on a man-in-the-middle network position, which is reflected by AC:H; no public exploit has been identified at time of analysis. This is a moderate-severity, this_month-priority issue rather than an emergency, and vendor fixes are available per Tanium advisory TAN-2026-060.
Local information disclosure in Tanium Threat Response Client Extension and Endpoint Configuration Toolset Solution is reachable only by a low-privileged local user and depends on a high-complexity condition outside the attacker's control, so impact is limited to low confidentiality exposure and minor availability loss. No public exploit code was identified at time of analysis, and Tanium has published fixed builds under advisory TAN-2026-056.
Denial of service in Tanium Enforce (2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373) lets unauthenticated remote attackers degrade the Enforce service by consuming a resource that is not bounded or throttled (CWE-770). The CVSS 3.1 score of 5.3 reflects network reachability with low attack complexity and no privileges or user interaction, but impact is confined to low availability with no confidentiality or integrity effect, so successful abuse causes partial service degradation rather than system compromise or full outage. No public exploit code was identified at time of analysis and no CISA KEV entry exists; Tanium has released fixed builds and the advisory is TAN-2026-052.
A use-after-free memory-corruption flaw in the Tanium Threat Response Client Extension requires local access to a host plus pre-existing low-level privileges, and its worst outcome is partial availability loss of the client extension - no confidentiality or integrity impact. Tanium has released fixed builds across the Endpoint Configuration Toolset Solution (1.51, 1.59, 1.71 branches) and multiple threat-response-cx branches per advisory TAN-2026-068. This is a low-priority issue: no public exploit code, PoC reference, or CISA KEV entry is present in the available data, and the priority label is monitor.
A remote, unauthenticated denial-of-service condition in Tanium Server lets an attacker exhaust server resources by sending crafted requests to the reachable management service, degrading availability only (CVSS 5.3, A:L). Deployments are affected if they run builds below 7.7.3.8351, 7.8.2.1263, or 7.8.4.1399, and patched builds are published for all three branches. No public exploit code or active exploitation has been identified in the supplied sources, so the practical risk is highest for internet-exposed or poorly segmented Tanium Server instances.
Infinite-loop denial of service in Tanium Threat Response client extension and Endpoint Configuration Toolset Solution allows a local user with low privileges to hang the affected endpoint component, reducing availability only. Affected builds are Threat Response CX before 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271, and 1.21.1673, and Endpoint Configuration Toolset Solution before 1.51.60, 1.59.50, and 1.71.25. The vendor has released fixes, no public exploit identified at time of analysis, no CISA KEV entry, and the issue is rated monitor priority.
Authenticated SQL injection in Tanium Provision can expose or modify data and cause limited service disruption for a low-privileged user who already holds a valid session. Provision 1.17 before 1.17.150, 1.23 before 1.23.161, and 1.24 before 1.24.199 are affected, and Tanium has released fixed builds for each branch. The vendor rates the issue CVSS 6.3 with PR:L and UI:N, the vulnerable endpoint or parameter is not identified in the available sources, and no public exploit was identified at time of analysis.
An authenticated SQL injection (CWE-89) in the Tanium Patch module lets a low-privilege user with valid console credentials and network access to the Patch component read data they should not be able to reach, with confidentiality impact rated High and no integrity or availability effect (CVSS 6.5, PR:L, UI:N). Deployments running Patch 3.24 before 3.24.306, 3.28 before 3.28.325, or 3.32 before 3.32.353 are affected. No public exploit code and no confirmed active exploitation were identified at the time of analysis; the authentication prerequisite confines practical exposure to insiders or attackers who already hold a foothold.
Tanium Threat Response can write sensitive information into log files (CWE-532), exposing confidential data to anyone who can read the affected logs. Affected builds are Threat Response 4.17 before 4.17.327, 4.12 before 4.12.349, and 4.9 before 4.9.476; Tanium has released fixed versions. The CVSS 3.1 base score is 4.2 (MEDIUM) and the vuln.today decision label is 'this_month' - a low-to-moderate priority issue, not an emergency; no public exploit code or CISA KEV entry is reported in the supplied data. The vendor vector and the independent assessed vector differ on access path and prerequisites (network/high-privilege/user-interaction versus local/low-privilege/no-interaction), but both limit impact to confidentiality.
Improper access controls in Tanium Threat Response let an authenticated, high-privilege operator (PR:H) reach a function that lacks an adequate authorization check, allowing them to read or modify data outside their assigned scope over the network without user interaction. The vendor addressed the flaw (tracked as TAN-2026-034) and the impact is limited - confidentiality and integrity are both rated Low and there is no availability impact - yielding a CVSS 3.1 base score of 3.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the high-privilege prerequisite plus narrow scope keep real-world risk low.
Improper access controls in Tanium Threat Response let an attacker who already holds a valid low-privileged account manipulate objects they should not be authorized to reach, producing a high integrity impact and limited confidentiality exposure. The flaw is network-reachable and low-complexity but is not pre-authentication: the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) confirms the attacker must first authenticate with low privileges, so the 'Authentication Bypass' tag in the source intelligence should be read as an authorization bypass rather than an unauthenticated entry point. No public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation is not confirmed actively exploited; Tanium self-reported the issue and published advisory TAN-2026-048.
An authenticated server-side request forgery (SSRF) in Tanium Threat Response allows a user who already holds valid console or module credentials to coerce the Tanium server into making requests to attacker-influenced URLs, potentially disclosing internal-only resources. The vendor scores it 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), which matches our independent assessment: remote reachability with low attack complexity, but the low-privilege authentication requirement is the main limiting factor and there is no user interaction needed. Impact is confined to confidentiality (high) with no integrity or availability effect and no scope change, and no public exploit code or confirmed active exploitation was identified at the time of analysis.
Information disclosure in the Tanium Discover module allows an authenticated console user to read data they should not have access to, with the vendor confirming the flaw has been addressed. The vulnerability requires network reachability and a valid low-privilege Tanium session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) but no user interaction, and it affects only organizations that have licensed and deployed the optional Discover component. Impact is confined to confidentiality - there is no integrity or availability effect - and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Improper access controls in Tanium Comply (CWE-862, Missing Authorization) allow authenticated low-privileged users to perform unauthorized actions affecting the integrity and availability of the compliance module. Three active release branches are affected - 2.32.x, 2.35.x, and 2.37.x - with vendor-issued patches available for each. No active exploitation has been identified and no public proof-of-concept exists at time of analysis.
Improper access controls in Tanium Comply allow an authenticated low-privileged network user to perform write operations beyond their authorization level, resulting in high integrity impact. Three active release branches are affected: 2.32, 2.35, and 2.37, each with specific fixed builds released by Tanium under advisory TAN-2026-029. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the network-accessible, low-complexity vector lowers the bar for exploitation by any authenticated user.
Authenticated information disclosure in Tanium Server across three supported release branches (7.7.3, 7.8.2, and 7.8.4) allows a low-privilege network user to access data they are not authorized to view, as described in vendor advisory TAN-2026-033. The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms the flaw is network-reachable, low-complexity, and requires only standard credentials with no user interaction. Vendor-released patches are available for all affected branches; no public exploit code or CISA KEV listing exists at time of analysis.
Information disclosure in Tanium Comply allows authenticated low-privilege network users to access data beyond their authorization level. Versions in the 2.37 branch prior to 2.37.308 are confirmed affected per the EUVD advisory tied to vendor bulletin TAN-2026-032. No public exploit code or active exploitation has been identified; Tanium self-reported and patched the issue.
Improper access controls in Tanium Comply allow authenticated low-privileged users to perform unauthorized actions affecting integrity and availability via CWE-639 (Authorization Bypass Through User-Controlled Key). Affected versions span three active release branches: 2.32, 2.35, and 2.37, each with specific fixed builds. Tanium has released patched versions and no active exploitation or public exploit code has been identified at time of analysis.
Improper access control (CWE-863) in Tanium Server allows authenticated low-privilege users to impact platform availability without the required authorization. Affecting three active version branches (7.7.3, 7.8.2, and 7.8.4), the flaw was self-reported and patched by Tanium under advisory TAN-2026-031. No public exploit code or active exploitation has been identified at time of analysis.
Improper access controls in Tanium Comply allow an authenticated low-privileged user to perform unauthorized write actions against compliance data or configuration, resulting in limited integrity impact. Affected across three active release branches - 2.32, 2.35, and 2.37 - with specific patch thresholds published by Tanium. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing this in the category of moderate enterprise risk requiring patching within standard change-management windows.
Tanium Comply contains an improper access control vulnerability (CWE-639, Authorization Bypass Through User-Controlled Key) that allows authenticated low-privileged users to perform unauthorized integrity-affecting or availability-impacting actions against compliance data by manipulating user-controlled object references. Affected branches span three minor release lines (2.32, 2.35, 2.37) with fixed versions available. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the medium CVSS score of 5.4. The vendor (Tanium) self-reported and released patches across all affected branches.
Improper access controls in Tanium Comply allow authenticated low-privileged users to bypass object-level authorization and access or manipulate compliance data belonging to other users or tenants. Affecting three active release branches (2.32, 2.35, 2.37), the flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of vulnerability commonly known as Insecure Direct Object Reference (IDOR). Tanium self-disclosed and patched the issue via advisory TAN-2026-038; no public exploit or active exploitation has been identified at time of analysis.
Improper access controls in Tanium Comply allow an authenticated low-privileged user to perform unauthorized write operations they should not be permitted to execute. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application fails to enforce object-level authorization checks, allowing a user to manipulate resource identifiers to access or modify other users' or roles' data. No public exploit has been identified at time of analysis, and EPSS data is not available in the provided intelligence.
Path traversal in Tanium Data Service 4.2 prior to build 4.2.345 allows a highly privileged, remote-authenticated attacker to read, write, or otherwise manipulate files outside the application's intended directory scope. Tanium addressed this in their security advisory TAN-2026-044 with a patch to build 4.2.345. No public exploit or active exploitation has been identified at time of analysis.
Improper access controls in Tanium Comply (CWE-862 Missing Authorization) allow authenticated low-privilege users to perform actions or access data beyond their authorized scope. Three active release branches are affected: 2.32, 2.35, and 2.37. No public exploit code and no CISA KEV listing have been identified at time of analysis; Tanium has released patched builds across all affected branches.
SQL injection in Tanium Patch allows authenticated low-privilege attackers to read, modify, or delete data from the backend database via crafted network requests. The vulnerability affects all versions prior to the vendor-released patch identified in advisory TAN-2026-019. No public exploit code or active exploitation has been reported.
Information disclosure in Tanium Connect exposes sensitive data to local administrators via process invocation metadata. The vulnerability (CWE-214) allows a locally authenticated, highly privileged user to observe sensitive information - such as credentials or tokens - that the Connect component surfaces through visible process arguments or environment state. No active exploitation has been identified and no public proof-of-concept exists, but the high confidentiality impact (C:H) means exposed data could facilitate lateral movement or privilege escalation within the Tanium management plane.
UI Misrepresentation of Critical Information in Tanium Server enables a highly privileged network-accessible attacker to alter how critical data is presented within the administrative interface, potentially causing other operators to make incorrect security decisions based on falsified or obscured information. Classified under CWE-451, the flaw carries a CVSS score of 2.7 (Low), reflecting the high privilege barrier required for exploitation. No public exploit identified at time of analysis, and no CISA KEV listing has been associated with this vulnerability.
Tanium Server allows high-privileged authenticated users to disclose sensitive information through an unspecified network-accessible mechanism. The vulnerability requires administrative or equivalent privileges and carries a low CVSS score (2.7) reflecting limited impact to confidentiality with no integrity or availability consequences. No active exploitation or public proof-of-concept has been identified.
Information disclosure vulnerability in Tanium Threat Response allows high-privileged authenticated users to access sensitive data via network requests. The vulnerability affects all versions of Threat Response and requires administrator-level privileges to exploit, resulting in confidentiality impact with no integrity or availability compromise. No active exploitation has been publicly identified.
Uncontrolled resource consumption in Tanium Interact allows authenticated high-privilege administrators to trigger a denial of service condition through network-accessible endpoints. The vulnerability requires high-level administrative privileges (PR:H) and produces only availability impact with no confidentiality or integrity compromise. CVSS base score of 2.7 reflects the severe privilege barrier and limited impact scope.
Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS. [CVSS 5.3 MEDIUM]
Tanium addressed a SQL injection vulnerability in Asset. [CVSS 6.3 MEDIUM]
Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension. [CVSS 4.7 MEDIUM]
Tanium Interact logs sensitive information that authenticated users can access, potentially exposing confidential data through log file inspection. The vulnerability requires valid credentials and does not allow modification or service disruption, limiting its impact to information disclosure.
Tanium addressed an insertion of sensitive information into log file vulnerability in Trends. [CVSS 6.5 MEDIUM]
Enforce Recovery Key Portal is affected by incorrect permission assignment for critical resource (CVSS 6.5).
Tanium addressed an arbitrary file deletion vulnerability in end-user-cx. [CVSS 5.5 MEDIUM]
Tanium addressed an arbitrary file deletion vulnerability in Tanium EUSS. [CVSS 5.5 MEDIUM]
Endpoint Configuration Toolset Solution is affected by improper link resolution before file access (CVSS 7.8).
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. [CVSS 7.8 HIGH]
Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools. [CVSS 5.5 MEDIUM]
Tanium addressed an uncontrolled resource consumption vulnerability in Tanium Server. [CVSS 6.5 MEDIUM]
Tanium addressed a local privilege escalation vulnerability in Tanium Server. [CVSS 6.7 MEDIUM]
Tanium addressed a local privilege escalation vulnerability in Tanium Module Server. [CVSS 6.7 MEDIUM]
Tanium addressed a denial of service vulnerability in Tanium Client. [CVSS 3.3 LOW]
Tanium addressed an incorrect default permissions vulnerability in Enforce. [CVSS 6.5 MEDIUM]
Tanium addressed an improper access controls vulnerability in Reputation. [CVSS 4.3 MEDIUM]
Tanium addressed an incorrect default permissions vulnerability in Benchmark. [CVSS 6.5 MEDIUM]
Tanium addressed an incorrect default permissions vulnerability in Comply. [CVSS 6.5 MEDIUM]
Tanium addressed an incorrect default permissions vulnerability in Discover. [CVSS 6.5 MEDIUM]
Tanium addressed an incorrect default permissions vulnerability in Partner Integration. [CVSS 6.5 MEDIUM]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauthorized code on the affected module. Certificate Manager 1.17 before 1.17.417, 1.18 before 1.18.368, and 1.22 before 1.22.119 are affected; the vendor has released fixed builds and vuln.today assigns this_week priority. No public exploit identified at time of analysis.
Uncontrolled resource consumption in Tanium Enforce allows remote attackers to degrade or exhaust service availability across the 2.9, 2.10, and 3.0 branches, rated CVSS 7.5 with availability-only impact (C:N/I:N/A:H). The assessed vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity attack requiring no privileges or user interaction, though the vendor description does not name the specific feature, protocol, or request type that triggers the exhaustion, and practical exposure is bounded by network reachability of an endpoint-management console normally deployed inside a managed enterprise perimeter. Vendor patches are available in Enforce 2.9.736, 2.10.778, and 3.0.373; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or KEV data was supplied.
Local privilege escalation in Tanium End-User CX and the Tanium Endpoint Configuration Toolset Solution lets a user who is already logged on with low privileges raise their rights to a high-impact level (C:H/I:H/A:H) on the affected endpoint, with no user interaction required. Affected builds are end-user-cx releases up to 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 and 1.24.590, plus Endpoint Configuration Toolset Solution 1.51.60, 1.59.50 and 1.71.25; Tanium has released fixes for these branches. No public exploit was identified at time of analysis, and the weakness is classified as CWE-59 link following, although the sources do not describe the precise file or link condition that triggers it. The realistic exposure is a post-compromise scenario on an enterprise agent endpoint rather than a network-facing attack, which is why the priority is 'this_week' rather than emergency action.
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code remotely, with high confidentiality, integrity, and availability impact (CVSS 8.8; AV:N/AC:L/PR:L/UI:N). Affected branches are 4.17 before 4.17.327, 4.12 before 4.12.349, and 4.9 before 4.9.476, and the vendor has released fixed builds. No public exploit identified at time of analysis; active exploitation is not confirmed in the provided sources, and the vuln.today priority is this_week, reflecting a credible near-term priority rather than an inflated high-CVSS score.
Local privilege escalation in Tanium End-User CX and the Endpoint Configuration Toolset Solution allows an authenticated low-privileged user with local access to a managed endpoint to gain high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). The flaw is in the End-User Notifications component and is classified as CWE-59 link following; Tanium reports a vendor patch in advisory TAN-2026-058. This is a credible but non-emergency issue: no public exploit identified at time of analysis, no CISA KEV active-exploitation signal is present in the supplied data, and exploitation requires an existing local foothold.
Denial of service in Tanium Provision allows unauthenticated remote attackers to degrade availability of affected Provision instances - 1.17 before 1.17.150, 1.23 before 1.23.161 and 1.24 before 1.24.199 - with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so confidentiality and integrity are unaffected. Tanium has released fixed builds (1.17.150, 1.23.161 and 1.24.199); no public exploit was identified at time of analysis and the issue is not in CISA KEV. Priority is this_week: the practical risk hinges on whether the Provision service is reachable from untrusted networks or confined to a management segment.
Improper output sanitization in Tanium Enforce 2.9, 2.10, and 3.0 allows a network-reachable attacker to craft malicious output that can lead to limited information disclosure and integrity impact when a legitimate user views or exports affected data (CVSS 7.1). The CVSS vector indicates no required privileges (PR:N) but user interaction (UI:R) is required, and whether injecting the payload itself requires prior authenticated access to Enforce is unverified; no public exploit identified at time of analysis. Tanium has released fixed builds in Enforce 2.9.736, 2.10.778, and 3.0.373, and the vuln.today priority engine rates remediation as 'this_week'.
Improper output sanitization in Tanium Comply allows a remote, unauthenticated attacker to introduce crafted content that is rendered or exported when an authorized operator views the affected output, with the scope change indicating impact beyond the attacker-controlled component, such as the operator's session or an exported file. Only Comply 2.32 before 2.32.263, 2.35 before 2.35.323, and 2.37 before 2.37.326 are affected; confidentiality, integrity, and availability impacts are Low, and the required user interaction is the main limiting factor. No public exploit was identified at the time of analysis, and patched builds are available from Tanium.
A heap-based buffer overflow in Tanium's Index component (index-cx), also shipped within the Endpoint Configuration Toolset Solution, allows an attacker who already holds local access and low-level privileges on an endpoint to corrupt heap memory, with the potential for code execution at the integrity level of the affected Index process (CVSS 3.1: 7.8, AV:L/PR:L/AC:L, C/I/A all High, Scope Unchanged). Only hosts running the affected index-cx builds (3.9.x, 3.11.x, 3.14.x, 3.15.x, 3.16.x) or Endpoint Configuration Toolset Solution 1.51, 1.59 and 1.71 branches are exposed; the flaw is not reachable remotely or without credentials per the assessed vector. No public exploit code has been identified at time of analysis and there is no KEV listing, but Tanium has released fixed builds and the issue is prioritized for remediation this week.
Denial of service in Tanium Enforce (3.0 before 3.0.373, 2.10 before 2.10.778, and 2.9 before 2.9.736) lets remote attackers consume resources by getting a highly compressed payload into a decompression path, a compression bomb (CWE-409) carrying an availability-only impact and a 7.5 severity score. Fixed builds are published by the vendor, and no public exploit code has been identified at time of analysis. The precise feature or input that performs the decompression is not described in the available sources, so the practical precondition remains the affected version plus the ability to deliver a crafted payload to that path.
Local privilege escalation in Tanium End-User CX (end-user-cx) and the Tanium Endpoint Configuration Toolset Solution lets an attacker who already holds a low-privileged local account on a managed endpoint leverage a link-following flaw (CWE-59) to gain high-integrity code execution, with CVSS 3.1 scoring 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only hosts running the pre-fix builds are exposed - end-user-cx below 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 or 1.24.590, and Endpoint Configuration Toolset Solution below 1.51.60, 1.59.50 or 1.71.25. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor has released fixed builds, and the practical exposure is limited to endpoints that are already multi-user or already partially compromised.
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-privileged, authenticated user to inject crafted input over the network and manipulate the backend SQL queries, producing high confidentiality, integrity and availability impact on the affected component. Exploitation requires a valid Threat Response console account or API credentials at low privilege (PR:L) plus network reachability to the management interface, but needs no user interaction and involves low attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis; Tanium addressed the issue and documents it in advisory TAN-2026-047.
SQL injection in the Tanium Asset module lets a high-privilege authenticated console user execute arbitrary SQL against the Asset data store, with the potential to read, modify, or destroy data the module manages (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The flaw is remotely reachable and requires no user interaction, but it is gated on two conditions: the optional Asset module must be deployed, and the attacker must already hold an elevated Tanium console session - a self-service or low-privilege account is insufficient. Affected builds are Asset before 1.33.326, before 1.36.174, and before 1.39.153; Tanium has released fixed versions and there is currently no public exploit identified at time of analysis, though the EPSS score is minimal and no CISA KEV listing applies.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlying Asset database, carrying a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a privileged account on the Asset module with network access to its interface and no user interaction; unauthenticated or low-privilege users cannot reach the vulnerable query path, and because Tanium is typically an internally deployed enterprise platform, realistic abuse is concentrated among insiders or attackers who have already escalated to a privileged Asset role. Publicly available exploit code exists (a public gist is referenced), but the issue is not in CISA KEV, so there is no confirmation of active exploitation in the wild. Fixed versions are available from the vendor.
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to perform unauthorized actions, producing high integrity and availability impact across the platform. Tanium disclosed this vulnerability via advisory TAN-2026-041; the CVSS 8.1 score reflects network-reachable exploitation requiring only a valid low-privilege account with no user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Server-side template injection (SSTI) in Tanium Comply enables remote code execution by a highly privileged authenticated user, yielding full confidentiality, integrity, and availability impact on the Comply server. The vulnerability (CWE-1336) results from insufficient neutralization of template directives in user-controlled input, allowing the underlying template engine to evaluate and execute injected payloads server-side. Tanium addressed this in advisory TAN-2026-040; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's intended directory scope, resulting in high confidentiality impact and scope change to the broader host system. The CVSS vector (S:C, C:H) indicates the traversal can reach resources beyond the Comply component itself, potentially exposing sensitive configuration, credentials, or endpoint compliance data accessible to the Tanium platform. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Tanium Enforce allows authenticated low-privileged users to cause the Enforce server to issue arbitrary HTTP requests to internal network resources outside the application's normal authorization boundary. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect that a successful attack can expose internal services, cloud metadata endpoints, or backend infrastructure inaccessible to the attacker directly. Tanium disclosed and addressed this issue in advisory TAN-2026-036; no public exploit code or active exploitation has been identified at time of analysis.
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user interaction and high attack complexity - to execute arbitrary SQL against the backend database, with a scope change that extends impact beyond the Comply application itself to C:H/I:H/A:H. Tanium addressed this in advisory TAN-2026-042. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Improper access controls (CWE-862 Missing Authorization) in Tanium Comply expose compliance and vulnerability assessment data to authenticated users who lack sufficient privileges to access it. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) scores this at 7.1, with high confidentiality impact and limited integrity risk, exploitable over the network by any low-privileged Tanium account holder with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write against the underlying host. The CVSS vector (AV:N/AC:L/PR:L/S:C/I:H) confirms the vulnerability is network-reachable without administrative credentials and breaks containment boundaries beyond the Comply module itself. Tanium addressed the issue under advisory TAN-2026-043; no public exploit code or CISA KEV listing is currently identified.
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations with high integrity and availability impact over the network. Exploiting this CWE-863 (Incorrect Authorization) flaw, an attacker with minimal authenticated access can bypass authorization enforcement within the Comply module, potentially altering compliance posture data or disrupting compliance workflows. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed.
OS command injection in Tanium Enforce enables a local attacker to execute arbitrary operating system commands at the privilege level of the Enforce agent process. The flaw (CWE-78) requires user interaction and specific exploitation preconditions, reflected in a CVSS 7.0 score despite full C:H/I:H/A:H impact ratings. Tanium self-disclosed the issue via advisory TAN-2026-022; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Denial of service in Tanium Server allows remote unauthenticated attackers to exhaust availability of the platform, per vendor advisory TAN-2026-016. The flaw is network-reachable with low complexity and no privileges or user interaction (CVSS 7.5, availability-only impact), and the CWE-789 classification indicates an uncontrolled/excessive memory allocation can be triggered remotely. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run arbitrary commands on the host, achieving full compromise of confidentiality, integrity, and availability. The CVSS 8.8 (network vector, low complexity, low privileges, no user interaction) reflects an authenticated remote code execution issue rooted in command injection (CWE-78). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; EPSS data was not provided.
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the underlying host, yielding full confidentiality, integrity, and availability compromise (CVSS 8.8). The flaw affects Connect branches 5.26, 5.29, and 5.37 below their respective fixed builds and is tagged as RCE/Command Injection. There is no public exploit identified at time of analysis, and EPSS estimates exploitation probability at a low 0.07% (22nd percentile).
Denial of service in Tanium Server allows remote unauthenticated attackers to exhaust resources and render the endpoint-management console unavailable, disrupting security operations across managed fleets. Rooted in a missing resource release (CWE-772), the flaw carries a 7.5 CVSS driven purely by availability impact, with no confidentiality or integrity effect; there is no public exploit identified at time of analysis and EPSS probability is negligible at 0.03%. A vendor patch is available across the 7.6, 7.7, and 7.8 branches.
Insufficient logging in Tanium Server branches 7.7.3, 7.8.2, and 7.8.4 can cause certain privileged operations to be incompletely recorded in audit logs, weakening forensic visibility and log integrity (CWE-778); the flaw requires high-privileged authenticated access (PR:H) and carries a low CVSS score of 2.7. No public exploit code has been identified at time of analysis, and Tanium has released fixed builds for all three affected branches.
Information disclosure in Tanium Server lets an authenticated low-privilege user expose limited sensitive data over the network, with no integrity or availability impact. The issue affects deployments running versions below 7.7.3.8351, 7.8.4.1399, and 7.8.2.1263, and Tanium has released fixed builds for each branch. Rated 4.3 with an AC:L/PR:L vector, it is a moderate-severity, lower-priority item - no public exploit identified at time of analysis and no CISA KEV listing.
Sensitive information disclosure in Tanium Reputation allows confidential data handled by the module to be written into Reputation log files, where a party able to read those logs can recover it. Deployments running Reputation 6.6 before 6.6.145, 6.7 before 6.7.138, or 6.8 before 6.8.162 are affected; the assessed vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) confines realistic impact to confidentiality loss for an authenticated, highly privileged party that already has log access, rather than to integrity or availability damage. No public exploit code has been identified at time of analysis, and vendor-released patches exist for all three affected branches.
An uncontrolled resource consumption flaw (CWE-770) in Tanium Enforce lets an authenticated user drive the Enforce component into resource exhaustion, degrading only the availability of that component. Deployments running Enforce 3.0 before 3.0.373, 2.9 before 2.9.736, or 2.10 before 2.10.778 are affected; patched builds are not exploitable. The CVSS score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), reflecting a low-impact, availability-only issue that requires a valid Enforce session - no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Tanium Comply builds 2.32 before 2.32.263, 2.35 before 2.35.323, and 2.37 before 2.37.326 enforce authorization incorrectly, allowing a low-privilege authenticated user with network access to read data outside their permitted scope. The flaw is rated CVSS 4.3 with confidentiality-only, low impact, and requires valid Comply credentials, so it is not exploitable without authentication; no public exploit was identified at time of analysis, and Tanium has released fixed builds.
Improper link resolution in the Tanium Threat Response Client Extension (threat-response-cx and the Endpoint Configuration Toolset Solution) allows an authenticated local attacker with low privileges to follow a manipulated link and read or write files outside the intended location, producing high confidentiality and integrity impact with no availability effect. Affected builds include threat-response-cx releases prior to 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271 and 1.21.1673, and Endpoint Configuration Toolset Solution releases prior to 1.51.60, 1.59.50 and 1.71.25. Exploitation is local-only and additionally depends on an unspecified high-complexity condition, so realistic abuse is limited to attackers who already hold a foothold on the endpoint; no public exploit code has been identified at time of analysis.
Improper access controls in Tanium Comply allow a low-privileged authenticated network user to reach functionality or data outside their intended permissions, with limited confidentiality, integrity, and availability impact and a scope change. Affected builds are Comply 2.32 before 2.32.263, 2.35 before 2.35.323, and 2.37 before 2.37.326; Tanium has released fixed builds in each branch. No public exploit has been identified at time of analysis, and the vendor's high attack-complexity rating keeps this a moderate-severity, lower-urgency issue.
Local denial of service in the Tanium Performance client extension (performance-cx) and the Tanium Endpoint Configuration Toolset Solution lets a user who already holds low-level privileges on an endpoint exhaust resources in the agent, degrading or halting its availability with no confidentiality or integrity impact. The flaw is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and requires local access to the host, so it is a moderate-severity issue rather than a top-tier priority. Tanium has released fixed builds and no public exploit was identified at time of analysis; priority is this_month.
Denial of service in Tanium Enforce allows an authenticated low-privileged user with network reachability to the Enforce component to crash the service through a null pointer dereference (CWE-476), rated CVSS 6.5 with availability impact High and no confidentiality or integrity effect. Affected deployments are Enforce 2.9 before 2.9.736, Enforce 2.10 before 2.10.778, and Enforce 3.0 before 3.0.373, and the vendor (Tanium, TAN-2026-074) has released fixed builds for each branch. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation is confined to users who already hold valid credentials on the Tanium platform.
An incorrect privilege assignment flaw (CWE-178) in Tanium Server allows a network-positioned attacker who already holds high privileges on the platform to gain full confidentiality, integrity and availability impact (C:H/I:H/A:H) by meeting a high-complexity precondition that is not detailed in the available sources. Affected releases are Tanium Server below 7.7.3.8351, below 7.8.2.1263 and below 7.8.4.1399; Tanium has published advisory TAN-2026-054 and fixed versions for each branch, so the exposure is limited to unpatched deployments. The vector requires PR:H and AC:H, meaning opportunistic or unauthenticated exploitation is infeasible from this data, and the vendor-reported severity is moderate at CVSS 6.6; no public exploit code or CISA KEV listing is present in the available intelligence, and the priority decision is 'this_month'.
Improper access controls in Tanium Enforce allow authenticated users with low privileges to read limited data they should not be able to access, with no integrity or availability impact. Enforce 2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373 are affected; CVSS 3.1 scores this 4.3 as a network-reachable, low-privilege issue requiring a valid session. No public exploit code was identified at time of analysis, and the vendor has released fixed builds.
Tanium Stream Client Extension (cx-stream) and Endpoint Configuration Toolset Solution do not properly validate certificates on the connections they initiate, so an attacker who can intercept or relay TLS traffic can impersonate the peer and disclose information (CVSS 6.5; C:H/I:N/A:L). The issue is unauthenticated (PR:N) and requires no user interaction (UI:N), but exploitation depends on a man-in-the-middle network position, which is reflected by AC:H; no public exploit has been identified at time of analysis. This is a moderate-severity, this_month-priority issue rather than an emergency, and vendor fixes are available per Tanium advisory TAN-2026-060.
Local information disclosure in Tanium Threat Response Client Extension and Endpoint Configuration Toolset Solution is reachable only by a low-privileged local user and depends on a high-complexity condition outside the attacker's control, so impact is limited to low confidentiality exposure and minor availability loss. No public exploit code was identified at time of analysis, and Tanium has published fixed builds under advisory TAN-2026-056.
Denial of service in Tanium Enforce (2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373) lets unauthenticated remote attackers degrade the Enforce service by consuming a resource that is not bounded or throttled (CWE-770). The CVSS 3.1 score of 5.3 reflects network reachability with low attack complexity and no privileges or user interaction, but impact is confined to low availability with no confidentiality or integrity effect, so successful abuse causes partial service degradation rather than system compromise or full outage. No public exploit code was identified at time of analysis and no CISA KEV entry exists; Tanium has released fixed builds and the advisory is TAN-2026-052.
A use-after-free memory-corruption flaw in the Tanium Threat Response Client Extension requires local access to a host plus pre-existing low-level privileges, and its worst outcome is partial availability loss of the client extension - no confidentiality or integrity impact. Tanium has released fixed builds across the Endpoint Configuration Toolset Solution (1.51, 1.59, 1.71 branches) and multiple threat-response-cx branches per advisory TAN-2026-068. This is a low-priority issue: no public exploit code, PoC reference, or CISA KEV entry is present in the available data, and the priority label is monitor.
A remote, unauthenticated denial-of-service condition in Tanium Server lets an attacker exhaust server resources by sending crafted requests to the reachable management service, degrading availability only (CVSS 5.3, A:L). Deployments are affected if they run builds below 7.7.3.8351, 7.8.2.1263, or 7.8.4.1399, and patched builds are published for all three branches. No public exploit code or active exploitation has been identified in the supplied sources, so the practical risk is highest for internet-exposed or poorly segmented Tanium Server instances.
Infinite-loop denial of service in Tanium Threat Response client extension and Endpoint Configuration Toolset Solution allows a local user with low privileges to hang the affected endpoint component, reducing availability only. Affected builds are Threat Response CX before 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271, and 1.21.1673, and Endpoint Configuration Toolset Solution before 1.51.60, 1.59.50, and 1.71.25. The vendor has released fixes, no public exploit identified at time of analysis, no CISA KEV entry, and the issue is rated monitor priority.
Authenticated SQL injection in Tanium Provision can expose or modify data and cause limited service disruption for a low-privileged user who already holds a valid session. Provision 1.17 before 1.17.150, 1.23 before 1.23.161, and 1.24 before 1.24.199 are affected, and Tanium has released fixed builds for each branch. The vendor rates the issue CVSS 6.3 with PR:L and UI:N, the vulnerable endpoint or parameter is not identified in the available sources, and no public exploit was identified at time of analysis.
An authenticated SQL injection (CWE-89) in the Tanium Patch module lets a low-privilege user with valid console credentials and network access to the Patch component read data they should not be able to reach, with confidentiality impact rated High and no integrity or availability effect (CVSS 6.5, PR:L, UI:N). Deployments running Patch 3.24 before 3.24.306, 3.28 before 3.28.325, or 3.32 before 3.32.353 are affected. No public exploit code and no confirmed active exploitation were identified at the time of analysis; the authentication prerequisite confines practical exposure to insiders or attackers who already hold a foothold.
Tanium Threat Response can write sensitive information into log files (CWE-532), exposing confidential data to anyone who can read the affected logs. Affected builds are Threat Response 4.17 before 4.17.327, 4.12 before 4.12.349, and 4.9 before 4.9.476; Tanium has released fixed versions. The CVSS 3.1 base score is 4.2 (MEDIUM) and the vuln.today decision label is 'this_month' - a low-to-moderate priority issue, not an emergency; no public exploit code or CISA KEV entry is reported in the supplied data. The vendor vector and the independent assessed vector differ on access path and prerequisites (network/high-privilege/user-interaction versus local/low-privilege/no-interaction), but both limit impact to confidentiality.
Improper access controls in Tanium Threat Response let an authenticated, high-privilege operator (PR:H) reach a function that lacks an adequate authorization check, allowing them to read or modify data outside their assigned scope over the network without user interaction. The vendor addressed the flaw (tracked as TAN-2026-034) and the impact is limited - confidentiality and integrity are both rated Low and there is no availability impact - yielding a CVSS 3.1 base score of 3.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the high-privilege prerequisite plus narrow scope keep real-world risk low.
Improper access controls in Tanium Threat Response let an attacker who already holds a valid low-privileged account manipulate objects they should not be authorized to reach, producing a high integrity impact and limited confidentiality exposure. The flaw is network-reachable and low-complexity but is not pre-authentication: the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) confirms the attacker must first authenticate with low privileges, so the 'Authentication Bypass' tag in the source intelligence should be read as an authorization bypass rather than an unauthenticated entry point. No public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation is not confirmed actively exploited; Tanium self-reported the issue and published advisory TAN-2026-048.
An authenticated server-side request forgery (SSRF) in Tanium Threat Response allows a user who already holds valid console or module credentials to coerce the Tanium server into making requests to attacker-influenced URLs, potentially disclosing internal-only resources. The vendor scores it 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), which matches our independent assessment: remote reachability with low attack complexity, but the low-privilege authentication requirement is the main limiting factor and there is no user interaction needed. Impact is confined to confidentiality (high) with no integrity or availability effect and no scope change, and no public exploit code or confirmed active exploitation was identified at the time of analysis.
Information disclosure in the Tanium Discover module allows an authenticated console user to read data they should not have access to, with the vendor confirming the flaw has been addressed. The vulnerability requires network reachability and a valid low-privilege Tanium session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) but no user interaction, and it affects only organizations that have licensed and deployed the optional Discover component. Impact is confined to confidentiality - there is no integrity or availability effect - and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Improper access controls in Tanium Comply (CWE-862, Missing Authorization) allow authenticated low-privileged users to perform unauthorized actions affecting the integrity and availability of the compliance module. Three active release branches are affected - 2.32.x, 2.35.x, and 2.37.x - with vendor-issued patches available for each. No active exploitation has been identified and no public proof-of-concept exists at time of analysis.
Improper access controls in Tanium Comply allow an authenticated low-privileged network user to perform write operations beyond their authorization level, resulting in high integrity impact. Three active release branches are affected: 2.32, 2.35, and 2.37, each with specific fixed builds released by Tanium under advisory TAN-2026-029. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the network-accessible, low-complexity vector lowers the bar for exploitation by any authenticated user.
Authenticated information disclosure in Tanium Server across three supported release branches (7.7.3, 7.8.2, and 7.8.4) allows a low-privilege network user to access data they are not authorized to view, as described in vendor advisory TAN-2026-033. The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms the flaw is network-reachable, low-complexity, and requires only standard credentials with no user interaction. Vendor-released patches are available for all affected branches; no public exploit code or CISA KEV listing exists at time of analysis.
Information disclosure in Tanium Comply allows authenticated low-privilege network users to access data beyond their authorization level. Versions in the 2.37 branch prior to 2.37.308 are confirmed affected per the EUVD advisory tied to vendor bulletin TAN-2026-032. No public exploit code or active exploitation has been identified; Tanium self-reported and patched the issue.
Improper access controls in Tanium Comply allow authenticated low-privileged users to perform unauthorized actions affecting integrity and availability via CWE-639 (Authorization Bypass Through User-Controlled Key). Affected versions span three active release branches: 2.32, 2.35, and 2.37, each with specific fixed builds. Tanium has released patched versions and no active exploitation or public exploit code has been identified at time of analysis.
Improper access control (CWE-863) in Tanium Server allows authenticated low-privilege users to impact platform availability without the required authorization. Affecting three active version branches (7.7.3, 7.8.2, and 7.8.4), the flaw was self-reported and patched by Tanium under advisory TAN-2026-031. No public exploit code or active exploitation has been identified at time of analysis.
Improper access controls in Tanium Comply allow an authenticated low-privileged user to perform unauthorized write actions against compliance data or configuration, resulting in limited integrity impact. Affected across three active release branches - 2.32, 2.35, and 2.37 - with specific patch thresholds published by Tanium. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing this in the category of moderate enterprise risk requiring patching within standard change-management windows.
Tanium Comply contains an improper access control vulnerability (CWE-639, Authorization Bypass Through User-Controlled Key) that allows authenticated low-privileged users to perform unauthorized integrity-affecting or availability-impacting actions against compliance data by manipulating user-controlled object references. Affected branches span three minor release lines (2.32, 2.35, 2.37) with fixed versions available. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the medium CVSS score of 5.4. The vendor (Tanium) self-reported and released patches across all affected branches.
Improper access controls in Tanium Comply allow authenticated low-privileged users to bypass object-level authorization and access or manipulate compliance data belonging to other users or tenants. Affecting three active release branches (2.32, 2.35, 2.37), the flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of vulnerability commonly known as Insecure Direct Object Reference (IDOR). Tanium self-disclosed and patched the issue via advisory TAN-2026-038; no public exploit or active exploitation has been identified at time of analysis.
Improper access controls in Tanium Comply allow an authenticated low-privileged user to perform unauthorized write operations they should not be permitted to execute. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application fails to enforce object-level authorization checks, allowing a user to manipulate resource identifiers to access or modify other users' or roles' data. No public exploit has been identified at time of analysis, and EPSS data is not available in the provided intelligence.
Path traversal in Tanium Data Service 4.2 prior to build 4.2.345 allows a highly privileged, remote-authenticated attacker to read, write, or otherwise manipulate files outside the application's intended directory scope. Tanium addressed this in their security advisory TAN-2026-044 with a patch to build 4.2.345. No public exploit or active exploitation has been identified at time of analysis.
Improper access controls in Tanium Comply (CWE-862 Missing Authorization) allow authenticated low-privilege users to perform actions or access data beyond their authorized scope. Three active release branches are affected: 2.32, 2.35, and 2.37. No public exploit code and no CISA KEV listing have been identified at time of analysis; Tanium has released patched builds across all affected branches.
SQL injection in Tanium Patch allows authenticated low-privilege attackers to read, modify, or delete data from the backend database via crafted network requests. The vulnerability affects all versions prior to the vendor-released patch identified in advisory TAN-2026-019. No public exploit code or active exploitation has been reported.
Information disclosure in Tanium Connect exposes sensitive data to local administrators via process invocation metadata. The vulnerability (CWE-214) allows a locally authenticated, highly privileged user to observe sensitive information - such as credentials or tokens - that the Connect component surfaces through visible process arguments or environment state. No active exploitation has been identified and no public proof-of-concept exists, but the high confidentiality impact (C:H) means exposed data could facilitate lateral movement or privilege escalation within the Tanium management plane.
UI Misrepresentation of Critical Information in Tanium Server enables a highly privileged network-accessible attacker to alter how critical data is presented within the administrative interface, potentially causing other operators to make incorrect security decisions based on falsified or obscured information. Classified under CWE-451, the flaw carries a CVSS score of 2.7 (Low), reflecting the high privilege barrier required for exploitation. No public exploit identified at time of analysis, and no CISA KEV listing has been associated with this vulnerability.
Tanium Server allows high-privileged authenticated users to disclose sensitive information through an unspecified network-accessible mechanism. The vulnerability requires administrative or equivalent privileges and carries a low CVSS score (2.7) reflecting limited impact to confidentiality with no integrity or availability consequences. No active exploitation or public proof-of-concept has been identified.
Information disclosure vulnerability in Tanium Threat Response allows high-privileged authenticated users to access sensitive data via network requests. The vulnerability affects all versions of Threat Response and requires administrator-level privileges to exploit, resulting in confidentiality impact with no integrity or availability compromise. No active exploitation has been publicly identified.
Uncontrolled resource consumption in Tanium Interact allows authenticated high-privilege administrators to trigger a denial of service condition through network-accessible endpoints. The vulnerability requires high-level administrative privileges (PR:H) and produces only availability impact with no confidentiality or integrity compromise. CVSS base score of 2.7 reflects the severe privilege barrier and limited impact scope.
Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS. [CVSS 5.3 MEDIUM]
Tanium addressed a SQL injection vulnerability in Asset. [CVSS 6.3 MEDIUM]
Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension. [CVSS 4.7 MEDIUM]
Tanium Interact logs sensitive information that authenticated users can access, potentially exposing confidential data through log file inspection. The vulnerability requires valid credentials and does not allow modification or service disruption, limiting its impact to information disclosure.
Tanium addressed an insertion of sensitive information into log file vulnerability in Trends. [CVSS 6.5 MEDIUM]
Enforce Recovery Key Portal is affected by incorrect permission assignment for critical resource (CVSS 6.5).
Tanium addressed an arbitrary file deletion vulnerability in end-user-cx. [CVSS 5.5 MEDIUM]
Tanium addressed an arbitrary file deletion vulnerability in Tanium EUSS. [CVSS 5.5 MEDIUM]
Endpoint Configuration Toolset Solution is affected by improper link resolution before file access (CVSS 7.8).
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. [CVSS 7.8 HIGH]
Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools. [CVSS 5.5 MEDIUM]
Tanium addressed an uncontrolled resource consumption vulnerability in Tanium Server. [CVSS 6.5 MEDIUM]
Tanium addressed a local privilege escalation vulnerability in Tanium Server. [CVSS 6.7 MEDIUM]
Tanium addressed a local privilege escalation vulnerability in Tanium Module Server. [CVSS 6.7 MEDIUM]
Tanium addressed a denial of service vulnerability in Tanium Client. [CVSS 3.3 LOW]
Tanium addressed an incorrect default permissions vulnerability in Enforce. [CVSS 6.5 MEDIUM]
Tanium addressed an improper access controls vulnerability in Reputation. [CVSS 4.3 MEDIUM]
Tanium addressed an incorrect default permissions vulnerability in Benchmark. [CVSS 6.5 MEDIUM]
Tanium addressed an incorrect default permissions vulnerability in Comply. [CVSS 6.5 MEDIUM]
Tanium addressed an incorrect default permissions vulnerability in Discover. [CVSS 6.5 MEDIUM]
Tanium addressed an incorrect default permissions vulnerability in Partner Integration. [CVSS 6.5 MEDIUM]