Threat Response
Monthly
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code remotely, with high confidentiality, integrity, and availability impact (CVSS 8.8; AV:N/AC:L/PR:L/UI:N). Affected branches are 4.17 before 4.17.327, 4.12 before 4.12.349, and 4.9 before 4.9.476, and the vendor has released fixed builds. No public exploit identified at time of analysis; active exploitation is not confirmed in the provided sources, and the vuln.today priority is this_week, reflecting a credible near-term priority rather than an inflated high-CVSS score.
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-privileged, authenticated user to inject crafted input over the network and manipulate the backend SQL queries, producing high confidentiality, integrity and availability impact on the affected component. Exploitation requires a valid Threat Response console account or API credentials at low privilege (PR:L) plus network reachability to the management interface, but needs no user interaction and involves low attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis; Tanium addressed the issue and documents it in advisory TAN-2026-047.
Tanium Threat Response can write sensitive information into log files (CWE-532), exposing confidential data to anyone who can read the affected logs. Affected builds are Threat Response 4.17 before 4.17.327, 4.12 before 4.12.349, and 4.9 before 4.9.476; Tanium has released fixed versions. The CVSS 3.1 base score is 4.2 (MEDIUM) and the vuln.today decision label is 'this_month' - a low-to-moderate priority issue, not an emergency; no public exploit code or CISA KEV entry is reported in the supplied data. The vendor vector and the independent assessed vector differ on access path and prerequisites (network/high-privilege/user-interaction versus local/low-privilege/no-interaction), but both limit impact to confidentiality.
Improper access controls in Tanium Threat Response let an authenticated, high-privilege operator (PR:H) reach a function that lacks an adequate authorization check, allowing them to read or modify data outside their assigned scope over the network without user interaction. The vendor addressed the flaw (tracked as TAN-2026-034) and the impact is limited - confidentiality and integrity are both rated Low and there is no availability impact - yielding a CVSS 3.1 base score of 3.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the high-privilege prerequisite plus narrow scope keep real-world risk low.
Improper access controls in Tanium Threat Response let an attacker who already holds a valid low-privileged account manipulate objects they should not be authorized to reach, producing a high integrity impact and limited confidentiality exposure. The flaw is network-reachable and low-complexity but is not pre-authentication: the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) confirms the attacker must first authenticate with low privileges, so the 'Authentication Bypass' tag in the source intelligence should be read as an authorization bypass rather than an unauthenticated entry point. No public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation is not confirmed actively exploited; Tanium self-reported the issue and published advisory TAN-2026-048.
An authenticated server-side request forgery (SSRF) in Tanium Threat Response allows a user who already holds valid console or module credentials to coerce the Tanium server into making requests to attacker-influenced URLs, potentially disclosing internal-only resources. The vendor scores it 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), which matches our independent assessment: remote reachability with low attack complexity, but the low-privilege authentication requirement is the main limiting factor and there is no user interaction needed. Impact is confined to confidentiality (high) with no integrity or availability effect and no scope change, and no public exploit code or confirmed active exploitation was identified at the time of analysis.
Information disclosure vulnerability in Tanium Threat Response allows high-privileged authenticated users to access sensitive data via network requests. The vulnerability affects all versions of Threat Response and requires administrator-level privileges to exploit, resulting in confidentiality impact with no integrity or availability compromise. No active exploitation has been publicly identified.
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.3 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.3 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.3 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.9 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.9 MEDIUM]
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code remotely, with high confidentiality, integrity, and availability impact (CVSS 8.8; AV:N/AC:L/PR:L/UI:N). Affected branches are 4.17 before 4.17.327, 4.12 before 4.12.349, and 4.9 before 4.9.476, and the vendor has released fixed builds. No public exploit identified at time of analysis; active exploitation is not confirmed in the provided sources, and the vuln.today priority is this_week, reflecting a credible near-term priority rather than an inflated high-CVSS score.
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-privileged, authenticated user to inject crafted input over the network and manipulate the backend SQL queries, producing high confidentiality, integrity and availability impact on the affected component. Exploitation requires a valid Threat Response console account or API credentials at low privilege (PR:L) plus network reachability to the management interface, but needs no user interaction and involves low attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis; Tanium addressed the issue and documents it in advisory TAN-2026-047.
Tanium Threat Response can write sensitive information into log files (CWE-532), exposing confidential data to anyone who can read the affected logs. Affected builds are Threat Response 4.17 before 4.17.327, 4.12 before 4.12.349, and 4.9 before 4.9.476; Tanium has released fixed versions. The CVSS 3.1 base score is 4.2 (MEDIUM) and the vuln.today decision label is 'this_month' - a low-to-moderate priority issue, not an emergency; no public exploit code or CISA KEV entry is reported in the supplied data. The vendor vector and the independent assessed vector differ on access path and prerequisites (network/high-privilege/user-interaction versus local/low-privilege/no-interaction), but both limit impact to confidentiality.
Improper access controls in Tanium Threat Response let an authenticated, high-privilege operator (PR:H) reach a function that lacks an adequate authorization check, allowing them to read or modify data outside their assigned scope over the network without user interaction. The vendor addressed the flaw (tracked as TAN-2026-034) and the impact is limited - confidentiality and integrity are both rated Low and there is no availability impact - yielding a CVSS 3.1 base score of 3.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the high-privilege prerequisite plus narrow scope keep real-world risk low.
Improper access controls in Tanium Threat Response let an attacker who already holds a valid low-privileged account manipulate objects they should not be authorized to reach, producing a high integrity impact and limited confidentiality exposure. The flaw is network-reachable and low-complexity but is not pre-authentication: the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) confirms the attacker must first authenticate with low privileges, so the 'Authentication Bypass' tag in the source intelligence should be read as an authorization bypass rather than an unauthenticated entry point. No public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation is not confirmed actively exploited; Tanium self-reported the issue and published advisory TAN-2026-048.
An authenticated server-side request forgery (SSRF) in Tanium Threat Response allows a user who already holds valid console or module credentials to coerce the Tanium server into making requests to attacker-influenced URLs, potentially disclosing internal-only resources. The vendor scores it 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), which matches our independent assessment: remote reachability with low attack complexity, but the low-privilege authentication requirement is the main limiting factor and there is no user interaction needed. Impact is confined to confidentiality (high) with no integrity or availability effect and no scope change, and no public exploit code or confirmed active exploitation was identified at the time of analysis.
Information disclosure vulnerability in Tanium Threat Response allows high-privileged authenticated users to access sensitive data via network requests. The vulnerability affects all versions of Threat Response and requires administrator-level privileges to exploit, resulting in confidentiality impact with no integrity or availability compromise. No active exploitation has been publicly identified.
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.3 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.3 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.3 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.9 MEDIUM]
Tanium addressed an information disclosure vulnerability in Threat Response. [CVSS 4.9 MEDIUM]