Search
Find a vulnerability
Search criteria
136 vulnerabilities by Tanium
CVE-2026-116661 (GCVE-0-2026-116661)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:18 – Updated: 2026-11-06 19:11
VLAI
EPSS
VEX
Title
Tanium addressed an improper access controls vulnerability in Enforce.
Summary
Tanium addressed an improper access controls vulnerability in Enforce.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:10 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
Impacted products
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116661",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:10:56.163994Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:11:10.262Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Enforce",
"vendor": "Tanium",
"versions": [
{
"lessThan": "3.0.373",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
},
{
"lessThan": "2.10.778",
"status": "affected",
"version": "2.10.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:08.209Z",
"datePublic": "2026-11-03T22:12:13.004Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper access controls vulnerability in Enforce."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:18:00.972Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-096",
"url": "https://security.tanium.com/TAN-2026-096"
}
],
"title": "Tanium addressed an improper access controls vulnerability in Enforce."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116661",
"datePublished": "2026-11-03T22:18:00.972Z",
"dateReserved": "2026-10-26T19:15:08.361Z",
"dateUpdated": "2026-11-06T19:11:10.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116650 (GCVE-0-2026-116650)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:18 – Updated: 2026-11-06 19:17
VLAI
EPSS
VEX
Title
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
Summary
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:17 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Threat Response |
Affected:
4.9 , < 4.9.480
(custom)
Affected: 4.12 , < 4.12.353 (custom) Affected: 4.17 , < 4.17.333 (custom) |
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116650",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:17:23.134717Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:17:37.453Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Threat Response",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.9.480",
"status": "affected",
"version": "4.9",
"versionType": "custom"
},
{
"lessThan": "4.12.353",
"status": "affected",
"version": "4.12",
"versionType": "custom"
},
{
"lessThan": "4.17.333",
"status": "affected",
"version": "4.17",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:03.892Z",
"datePublic": "2026-11-03T22:12:12.596Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an unauthorized code execution vulnerability in Threat Response."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:18:00.770Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-095",
"url": "https://security.tanium.com/TAN-2026-095"
}
],
"title": "Tanium addressed an unauthorized code execution vulnerability in Threat Response."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116650",
"datePublished": "2026-11-03T22:18:00.770Z",
"dateReserved": "2026-10-26T19:15:04.045Z",
"dateUpdated": "2026-11-06T19:17:37.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116668 (GCVE-0-2026-116668)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:18 – Updated: 2026-11-06 19:30
VLAI
EPSS
VEX
Title
Tanium addressed an uncontrolled resource consumption vulnerability in Discover.
Summary
Tanium addressed an uncontrolled resource consumption vulnerability in Discover.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:29 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
Impacted products
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116668",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:29:59.669027Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:30:11.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Discover",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.19.137",
"status": "affected",
"version": "4.19.0",
"versionType": "custom"
},
{
"lessThan": "4.15.218",
"status": "affected",
"version": "4.15.0",
"versionType": "custom"
},
{
"lessThan": "4.10.204",
"status": "affected",
"version": "4.10.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:10.925Z",
"datePublic": "2026-11-03T22:12:13.759Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an uncontrolled resource consumption vulnerability in Discover."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:18:00.566Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-098",
"url": "https://security.tanium.com/TAN-2026-098"
}
],
"title": "Tanium addressed an uncontrolled resource consumption vulnerability in Discover."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116668",
"datePublished": "2026-11-03T22:18:00.566Z",
"dateReserved": "2026-10-26T19:15:11.073Z",
"dateUpdated": "2026-11-06T19:30:11.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116666 (GCVE-0-2026-116666)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:18 – Updated: 2026-11-06 19:29
VLAI
EPSS
VEX
Title
Tanium addressed an information disclosure vulnerability in Discover.
Summary
Tanium addressed an information disclosure vulnerability in Discover.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:29 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
Impacted products
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116666",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:29:34.010427Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:29:46.409Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Discover",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.19.137",
"status": "affected",
"version": "4.19.0",
"versionType": "custom"
},
{
"lessThan": "4.15.218",
"status": "affected",
"version": "4.15.0",
"versionType": "custom"
},
{
"lessThan": "4.10.204",
"status": "affected",
"version": "4.10.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:10.127Z",
"datePublic": "2026-11-03T22:12:11.836Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an information disclosure vulnerability in Discover."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:18:00.373Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-093",
"url": "https://security.tanium.com/TAN-2026-093"
}
],
"title": "Tanium addressed an information disclosure vulnerability in Discover."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116666",
"datePublished": "2026-11-03T22:18:00.373Z",
"dateReserved": "2026-10-26T19:15:10.278Z",
"dateUpdated": "2026-11-06T19:29:46.409Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120775 (GCVE-0-2026-120775)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:17 – Updated: 2026-11-06 19:29
VLAI
EPSS
VEX
Title
Tanium addressed a heap-based buffer overflow vulnerability in Deploy.
Summary
Tanium addressed a heap-based buffer overflow vulnerability in Deploy.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:29 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
Impacted products
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120775",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:29:05.998551Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:29:17.643Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Deploy",
"vendor": "Tanium",
"versions": [
{
"lessThan": "2.45.322",
"status": "affected",
"version": "2.45.0",
"versionType": "custom"
},
{
"lessThan": "2.40.235",
"status": "affected",
"version": "2.40.0",
"versionType": "custom"
},
{
"lessThan": "2.36.294",
"status": "affected",
"version": "2.36.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-11-02T21:54:16.128Z",
"datePublic": "2026-11-03T22:12:10.312Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed a heap-based buffer overflow vulnerability in Deploy."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:17:24.355Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-089",
"url": "https://security.tanium.com/TAN-2026-089"
}
],
"title": "Tanium addressed a heap-based buffer overflow vulnerability in Deploy."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-120775",
"datePublished": "2026-11-03T22:17:24.355Z",
"dateReserved": "2026-11-02T21:54:16.642Z",
"dateUpdated": "2026-11-06T19:29:17.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116667 (GCVE-0-2026-116667)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:17 – Updated: 2026-11-06 19:28
VLAI
EPSS
VEX
Title
Tanium addressed an improper access controls vulnerability in Discover.
Summary
Tanium addressed an improper access controls vulnerability in Discover.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:28 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
Impacted products
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116667",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:28:37.270763Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:28:48.468Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Discover",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.19.137",
"status": "affected",
"version": "4.19.0",
"versionType": "custom"
},
{
"lessThan": "4.15.218",
"status": "affected",
"version": "4.15.0",
"versionType": "custom"
},
{
"lessThan": "4.10.204",
"status": "affected",
"version": "4.10.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:10.527Z",
"datePublic": "2026-11-03T22:12:08.810Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper access controls vulnerability in Discover."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:17:24.172Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-085",
"url": "https://security.tanium.com/TAN-2026-085"
}
],
"title": "Tanium addressed an improper access controls vulnerability in Discover."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116667",
"datePublished": "2026-11-03T22:17:24.172Z",
"dateReserved": "2026-10-26T19:15:10.680Z",
"dateUpdated": "2026-11-06T19:28:48.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116664 (GCVE-0-2026-116664)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:17 – Updated: 2026-11-06 19:28
VLAI
EPSS
VEX
Title
Tanium addressed an improper access controls vulnerability in Discover.
Summary
Tanium addressed an improper access controls vulnerability in Discover.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:28 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
Impacted products
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116664",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:28:11.078963Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:28:21.655Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Discover",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.19.137",
"status": "affected",
"version": "4.19.0",
"versionType": "custom"
},
{
"lessThan": "4.15.218",
"status": "affected",
"version": "4.15.0",
"versionType": "custom"
},
{
"lessThan": "4.10.204",
"status": "affected",
"version": "4.10.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:09.374Z",
"datePublic": "2026-11-03T22:12:11.069Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper access controls vulnerability in Discover."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:17:23.966Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-091",
"url": "https://security.tanium.com/TAN-2026-091"
}
],
"title": "Tanium addressed an improper access controls vulnerability in Discover."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116664",
"datePublished": "2026-11-03T22:17:23.966Z",
"dateReserved": "2026-10-26T19:15:09.524Z",
"dateUpdated": "2026-11-06T19:28:21.655Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116663 (GCVE-0-2026-116663)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:17 – Updated: 2026-11-06 19:19
VLAI
EPSS
VEX
Title
Tanium addressed an improper access controls vulnerability in Enforce.
Summary
Tanium addressed an improper access controls vulnerability in Enforce.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:18 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
Impacted products
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116663",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:18:03.811384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:19:45.922Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Enforce",
"vendor": "Tanium",
"versions": [
{
"lessThan": "3.0.373",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:08.970Z",
"datePublic": "2026-11-03T22:12:14.122Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper access controls vulnerability in Enforce."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:17:23.774Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-099",
"url": "https://security.tanium.com/TAN-2026-099"
}
],
"title": "Tanium addressed an improper access controls vulnerability in Enforce."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116663",
"datePublished": "2026-11-03T22:17:23.774Z",
"dateReserved": "2026-10-26T19:15:09.119Z",
"dateUpdated": "2026-11-06T19:19:45.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116648 (GCVE-0-2026-116648)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:17 – Updated: 2026-11-06 19:25
VLAI
EPSS
VEX
Title
Tanium addressed an improper output sanitization vulnerability in Discover.
Summary
Tanium addressed an improper output sanitization vulnerability in Discover.
Severity
4.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:25 UTC
CWE
- CWE-1236 - Improper Neutralization of Formula Elements in a CSV File
Assigner
References
1 reference
Impacted products
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116648",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:25:48.391903Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:25:57.879Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Discover",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.19.137",
"status": "affected",
"version": "4.19.0",
"versionType": "custom"
},
{
"lessThan": "4.15.218",
"status": "affected",
"version": "4.15.0",
"versionType": "custom"
},
{
"lessThan": "4.10.204",
"status": "affected",
"version": "4.10.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:03.099Z",
"datePublic": "2026-11-03T22:12:08.447Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper output sanitization vulnerability in Discover."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:17:23.571Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-084",
"url": "https://security.tanium.com/TAN-2026-084"
}
],
"title": "Tanium addressed an improper output sanitization vulnerability in Discover."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116648",
"datePublished": "2026-11-03T22:17:23.571Z",
"dateReserved": "2026-10-26T19:15:03.323Z",
"dateUpdated": "2026-11-06T19:25:57.879Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116665 (GCVE-0-2026-116665)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:17 – Updated: 2026-11-06 19:27
VLAI
EPSS
VEX
Title
Tanium addressed an information disclosure vulnerability in Discover.
Summary
Tanium addressed an information disclosure vulnerability in Discover.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:27 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
Impacted products
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116665",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:27:40.120369Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:27:52.128Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Discover",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.19.137",
"status": "affected",
"version": "4.19.0",
"versionType": "custom"
},
{
"lessThan": "4.15.218",
"status": "affected",
"version": "4.15.0",
"versionType": "custom"
},
{
"lessThan": "4.10.204",
"status": "affected",
"version": "4.10.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:09.740Z",
"datePublic": "2026-11-03T22:12:12.218Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an information disclosure vulnerability in Discover."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:17:23.388Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-094",
"url": "https://security.tanium.com/TAN-2026-094"
}
],
"title": "Tanium addressed an information disclosure vulnerability in Discover."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116665",
"datePublished": "2026-11-03T22:17:23.388Z",
"dateReserved": "2026-10-26T19:15:09.889Z",
"dateUpdated": "2026-11-06T19:27:52.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108327 (GCVE-0-2026-108327)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:17 – Updated: 2026-11-06 19:27
VLAI
EPSS
VEX
Title
Tanium addressed a path traversal vulnerability in Tanium Data Service.
Summary
Tanium addressed a path traversal vulnerability in Tanium Data Service.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:27 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Tanium Data Service |
Affected:
4.1 , < 4.1.281
(custom)
Affected: 4.2 , < 4.2.360 (custom) |
|
| Tanium | Interact |
Affected:
3.5.0 , < 3.5.141
(custom)
|
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108327",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:27:12.313070Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:27:24.863Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Tanium Data Service",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.1.281",
"status": "affected",
"version": "4.1",
"versionType": "custom"
},
{
"lessThan": "4.2.360",
"status": "affected",
"version": "4.2",
"versionType": "custom"
}
]
},
{
"product": "Interact",
"vendor": "Tanium",
"versions": [
{
"lessThan": "3.5.141",
"status": "affected",
"version": "3.5.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:32.959Z",
"datePublic": "2026-11-03T22:12:07.693Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed a path traversal vulnerability in Tanium Data Service."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:17:23.200Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-082",
"url": "https://security.tanium.com/TAN-2026-082"
}
],
"title": "Tanium addressed a path traversal vulnerability in Tanium Data Service."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108327",
"datePublished": "2026-11-03T22:17:23.200Z",
"dateReserved": "2026-10-09T19:21:33.118Z",
"dateUpdated": "2026-11-06T19:27:24.863Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121565 (GCVE-0-2026-121565)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:17 – Updated: 2026-11-06 19:26
VLAI
EPSS
VEX
Title
Tanium addressed an improper certificate validation vulnerability in multiple products
Summary
Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:26 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | TanOS |
Affected:
1.8.5 , < 1.8.5.0326
(custom)
Affected: 1.8.6 , < 1.8.6.0193 (custom) Affected: 1.9.0 , < 1.9.0.0089 (custom) |
|
| Tanium | Asset |
Affected:
1.33 , < 1.33.334
(custom)
Affected: 1.36 , < 1.36.182 (custom) Affected: 1.39 , < 1.39.164 (custom) |
|
| Tanium | Comply |
Affected:
2.32 , < 2.32.275
(custom)
Affected: 2.35 , < 2.35.337 (custom) Affected: 2.37 , < 2.37.347 (custom) |
|
| Tanium | Connect |
Affected:
5.29 , < 5.29.272
(custom)
Affected: 5.37 , < 5.37.177 (custom) Affected: 5.47 , < 5.47.135 (custom) |
|
| Tanium | Integrity Monitor |
Affected:
3.6 , < 3.6.608
(custom)
Affected: 3.7 , < 3.7.383 (custom) Affected: 3.8 , < 3.8.362 (custom) |
|
| Tanium | Health Check |
Affected:
1.13 , < 1.13.653
(custom)
|
|
| Tanium | Endpoint Configuration Toolset Solution |
Affected:
1.51 , < 1.51.61
(custom)
Affected: 1.59 , < 1.59.51 (custom) Affected: 1.71 , < 1.71.26 (custom) |
|
| Tanium | Patch |
Affected:
3.24 , < 3.24.328
(custom)
Affected: 3.28 , < 3.28.346 (custom) Affected: 3.32 , < 3.32.383 (custom) |
|
| Tanium | Performance |
Affected:
1.25 , < 1.25.196
(custom)
|
|
| Tanium | Reputation |
Affected:
6.6 , < 6.6.150
(custom)
Affected: 6.7 , < 6.7.143 (custom) Affected: 6.8 , < 6.8.167 (custom) |
|
| Tanium | Reveal |
Affected:
2.4 , < 2.4.109
(custom)
Affected: 2.5 , < 2.5.166 (custom) |
|
| Tanium | Threat Response |
Affected:
4.9 , < 4.9.480
(custom)
Affected: 4.12 , < 4.12.353 (custom) Affected: 4.17 , < 4.17.333 (custom) |
|
| Tanium | Provision Host |
Affected:
10.4.100 , < 10.4.100
(semver)
Affected: 10.8.115 , < 10.8.115 (semver) Affected: 10.9.113 , < 10.9.113 (semver) Affected: 10.10.189 , < 10.10.189 (semver) Affected: 10.11.127 , < 10.11.127 (semver) |
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121565",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:26:46.759376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:26:57.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TanOS",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.8.5.0326",
"status": "affected",
"version": "1.8.5",
"versionType": "custom"
},
{
"lessThan": "1.8.6.0193",
"status": "affected",
"version": "1.8.6",
"versionType": "custom"
},
{
"lessThan": "1.9.0.0089",
"status": "affected",
"version": "1.9.0",
"versionType": "custom"
}
]
},
{
"product": "Asset",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.33.334",
"status": "affected",
"version": "1.33",
"versionType": "custom"
},
{
"lessThan": "1.36.182",
"status": "affected",
"version": "1.36",
"versionType": "custom"
},
{
"lessThan": "1.39.164",
"status": "affected",
"version": "1.39",
"versionType": "custom"
}
]
},
{
"product": "Comply",
"vendor": "Tanium",
"versions": [
{
"lessThan": "2.32.275",
"status": "affected",
"version": "2.32",
"versionType": "custom"
},
{
"lessThan": "2.35.337",
"status": "affected",
"version": "2.35",
"versionType": "custom"
},
{
"lessThan": "2.37.347",
"status": "affected",
"version": "2.37",
"versionType": "custom"
}
]
},
{
"product": "Connect",
"vendor": "Tanium",
"versions": [
{
"lessThan": "5.29.272",
"status": "affected",
"version": "5.29",
"versionType": "custom"
},
{
"lessThan": "5.37.177",
"status": "affected",
"version": "5.37",
"versionType": "custom"
},
{
"lessThan": "5.47.135",
"status": "affected",
"version": "5.47",
"versionType": "custom"
}
]
},
{
"product": "Integrity Monitor",
"vendor": "Tanium",
"versions": [
{
"lessThan": "3.6.608",
"status": "affected",
"version": "3.6",
"versionType": "custom"
},
{
"lessThan": "3.7.383",
"status": "affected",
"version": "3.7",
"versionType": "custom"
},
{
"lessThan": "3.8.362",
"status": "affected",
"version": "3.8",
"versionType": "custom"
}
]
},
{
"product": "Health Check",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.13.653",
"status": "affected",
"version": "1.13",
"versionType": "custom"
}
]
},
{
"product": "Endpoint Configuration Toolset Solution",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.51.61",
"status": "affected",
"version": "1.51",
"versionType": "custom"
},
{
"lessThan": "1.59.51",
"status": "affected",
"version": "1.59",
"versionType": "custom"
},
{
"lessThan": "1.71.26",
"status": "affected",
"version": "1.71",
"versionType": "custom"
}
]
},
{
"product": "Patch",
"vendor": "Tanium",
"versions": [
{
"lessThan": "3.24.328",
"status": "affected",
"version": "3.24",
"versionType": "custom"
},
{
"lessThan": "3.28.346",
"status": "affected",
"version": "3.28",
"versionType": "custom"
},
{
"lessThan": "3.32.383",
"status": "affected",
"version": "3.32",
"versionType": "custom"
}
]
},
{
"product": "Performance",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.25.196",
"status": "affected",
"version": "1.25",
"versionType": "custom"
}
]
},
{
"product": "Reputation",
"vendor": "Tanium",
"versions": [
{
"lessThan": "6.6.150",
"status": "affected",
"version": "6.6",
"versionType": "custom"
},
{
"lessThan": "6.7.143",
"status": "affected",
"version": "6.7",
"versionType": "custom"
},
{
"lessThan": "6.8.167",
"status": "affected",
"version": "6.8",
"versionType": "custom"
}
]
},
{
"product": "Reveal",
"vendor": "Tanium",
"versions": [
{
"lessThan": "2.4.109",
"status": "affected",
"version": "2.4",
"versionType": "custom"
},
{
"lessThan": "2.5.166",
"status": "affected",
"version": "2.5",
"versionType": "custom"
}
]
},
{
"product": "Threat Response",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.9.480",
"status": "affected",
"version": "4.9",
"versionType": "custom"
},
{
"lessThan": "4.12.353",
"status": "affected",
"version": "4.12",
"versionType": "custom"
},
{
"lessThan": "4.17.333",
"status": "affected",
"version": "4.17",
"versionType": "custom"
}
]
},
{
"product": "Provision Host",
"vendor": "Tanium",
"versions": [
{
"lessThan": "10.4.100",
"status": "affected",
"version": "10.4.100",
"versionType": "semver"
},
{
"lessThan": "10.8.115",
"status": "affected",
"version": "10.8.115",
"versionType": "semver"
},
{
"lessThan": "10.9.113",
"status": "affected",
"version": "10.9.113",
"versionType": "semver"
},
{
"lessThan": "10.10.189",
"status": "affected",
"version": "10.10.189",
"versionType": "semver"
},
{
"lessThan": "10.11.127",
"status": "affected",
"version": "10.11.127",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2026-11-03T14:58:46.819Z",
"datePublic": "2026-11-03T22:12:11.458Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T11:24:05.622Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-092",
"url": "https://security.tanium.com/TAN-2026-092"
}
],
"title": "Tanium addressed an improper certificate validation vulnerability in multiple products"
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-121565",
"datePublished": "2026-11-03T22:17:22.997Z",
"dateReserved": "2026-11-03T14:58:47.328Z",
"dateUpdated": "2026-11-06T19:26:57.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116654 (GCVE-0-2026-116654)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:17 – Updated: 2026-11-06 19:26
VLAI
EPSS
VEX
Title
Tanium addressed an improper input validation vulnerability in Threat Response.
Summary
Tanium addressed an improper input validation vulnerability in Threat Response.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:26 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Threat Response |
Affected:
4.9 , < 4.9.480
(custom)
Affected: 4.12 , < 4.12.353 (custom) Affected: 4.17 , < 4.17.333 (custom) |
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116654",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:26:14.106206Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:26:27.336Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Threat Response",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.9.480",
"status": "affected",
"version": "4.9",
"versionType": "custom"
},
{
"lessThan": "4.12.353",
"status": "affected",
"version": "4.12",
"versionType": "custom"
},
{
"lessThan": "4.17.333",
"status": "affected",
"version": "4.17",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:05.463Z",
"datePublic": "2026-11-03T22:12:08.067Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper input validation vulnerability in Threat Response."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:17:22.790Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-083",
"url": "https://security.tanium.com/TAN-2026-083"
}
],
"title": "Tanium addressed an improper input validation vulnerability in Threat Response."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116654",
"datePublished": "2026-11-03T22:17:22.790Z",
"dateReserved": "2026-10-26T19:15:05.621Z",
"dateUpdated": "2026-11-06T19:26:27.336Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116651 (GCVE-0-2026-116651)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:16 – Updated: 2026-11-06 19:25
VLAI
EPSS
VEX
Title
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
Summary
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:25 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Threat Response |
Affected:
4.9 , < 4.9.480
(custom)
Affected: 4.12 , < 4.12.353 (custom) Affected: 4.17 , < 4.17.333 (custom) |
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116651",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:25:09.136521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:25:28.221Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Threat Response",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.9.480",
"status": "affected",
"version": "4.9",
"versionType": "custom"
},
{
"lessThan": "4.12.353",
"status": "affected",
"version": "4.12",
"versionType": "custom"
},
{
"lessThan": "4.17.333",
"status": "affected",
"version": "4.17",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:04.290Z",
"datePublic": "2026-11-03T22:12:09.930Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an unauthorized code execution vulnerability in Threat Response."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:16:44.969Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-088",
"url": "https://security.tanium.com/TAN-2026-088"
}
],
"title": "Tanium addressed an unauthorized code execution vulnerability in Threat Response."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116651",
"datePublished": "2026-11-03T22:16:44.969Z",
"dateReserved": "2026-10-26T19:15:04.488Z",
"dateUpdated": "2026-11-06T19:25:28.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116653 (GCVE-0-2026-116653)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:16 – Updated: 2026-11-06 19:24
VLAI
EPSS
VEX
Title
Tanium addressed an improper input validation vulnerability in Threat Response.
Summary
Tanium addressed an improper input validation vulnerability in Threat Response.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:24 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Threat Response |
Affected:
4.9 , < 4.9.480
(custom)
Affected: 4.12 , < 4.12.353 (custom) Affected: 4.17 , < 4.17.333 (custom) |
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116653",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:24:42.491419Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:24:53.792Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Threat Response",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.9.480",
"status": "affected",
"version": "4.9",
"versionType": "custom"
},
{
"lessThan": "4.12.353",
"status": "affected",
"version": "4.12",
"versionType": "custom"
},
{
"lessThan": "4.17.333",
"status": "affected",
"version": "4.17",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:05.086Z",
"datePublic": "2026-11-03T22:12:10.686Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper input validation vulnerability in Threat Response."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:16:44.773Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-090",
"url": "https://security.tanium.com/TAN-2026-090"
}
],
"title": "Tanium addressed an improper input validation vulnerability in Threat Response."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116653",
"datePublished": "2026-11-03T22:16:44.773Z",
"dateReserved": "2026-10-26T19:15:05.241Z",
"dateUpdated": "2026-11-06T19:24:53.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116652 (GCVE-0-2026-116652)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:15 – Updated: 2026-11-06 19:24
VLAI
EPSS
VEX
Title
Tanium addressed a business logic error in Threat Response.
Summary
Tanium addressed a business logic error in Threat Response.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:22 UTC
CWE
- CWE-628 - Function Call with Incorrectly Specified Arguments
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Threat Response |
Affected:
4.9 , < 4.9.480
(custom)
Affected: 4.12 , < 4.12.353 (custom) Affected: 4.17 , < 4.17.333 (custom) |
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116652",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:22:27.021630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:24:23.306Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Threat Response",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.9.480",
"status": "affected",
"version": "4.9",
"versionType": "custom"
},
{
"lessThan": "4.12.353",
"status": "affected",
"version": "4.12",
"versionType": "custom"
},
{
"lessThan": "4.17.333",
"status": "affected",
"version": "4.17",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:04.685Z",
"datePublic": "2026-11-03T22:12:07.255Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed a business logic error in Threat Response."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-628",
"description": "Function Call with Incorrectly Specified Arguments",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:15:27.872Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-081",
"url": "https://security.tanium.com/TAN-2026-081"
}
],
"title": "Tanium addressed a business logic error in Threat Response."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116652",
"datePublished": "2026-11-03T22:15:27.872Z",
"dateReserved": "2026-10-26T19:15:04.850Z",
"dateUpdated": "2026-11-06T19:24:23.306Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116669 (GCVE-0-2026-116669)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:14 – Updated: 2026-11-06 19:22
VLAI
EPSS
VEX
Title
Tanium addressed an improper access controls vulnerability in Discover.
Summary
Tanium addressed an improper access controls vulnerability in Discover.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:21 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
Impacted products
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116669",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:21:54.406561Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:22:07.815Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Discover",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.19.137",
"status": "affected",
"version": "4.19.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:11.287Z",
"datePublic": "2026-11-03T22:12:09.555Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper access controls vulnerability in Discover."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:14:50.030Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-087",
"url": "https://security.tanium.com/TAN-2026-087"
}
],
"title": "Tanium addressed an improper access controls vulnerability in Discover."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116669",
"datePublished": "2026-11-03T22:14:50.030Z",
"dateReserved": "2026-10-26T19:15:11.436Z",
"dateUpdated": "2026-11-06T19:22:07.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108324 (GCVE-0-2026-108324)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:14 – Updated: 2026-11-06 19:21
VLAI
EPSS
VEX
Title
Tanium addressed a denial of service vulnerability in Tanium Client.
Summary
Tanium addressed a denial of service vulnerability in Tanium Client.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:20 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Tanium Client |
Affected:
7.8.2 , < 7.8.2.1258
(custom)
Affected: 7.8.4 , < 7.8.4.1394 (custom) |
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108324",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:20:52.244544Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:21:34.792Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Tanium Client",
"vendor": "Tanium",
"versions": [
{
"lessThan": "7.8.2.1258",
"status": "affected",
"version": "7.8.2",
"versionType": "custom"
},
{
"lessThan": "7.8.4.1394",
"status": "affected",
"version": "7.8.4",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:31.915Z",
"datePublic": "2026-11-03T22:12:09.183Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed a denial of service vulnerability in Tanium Client."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:14:49.836Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-086",
"url": "https://security.tanium.com/TAN-2026-086"
}
],
"title": "Tanium addressed a denial of service vulnerability in Tanium Client."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108324",
"datePublished": "2026-11-03T22:14:49.836Z",
"dateReserved": "2026-10-09T19:21:32.074Z",
"dateUpdated": "2026-11-06T19:21:34.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116646 (GCVE-0-2026-116646)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:14 – Updated: 2026-11-06 19:20
VLAI
EPSS
VEX
Title
Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response.
Summary
Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:20 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Threat Response |
Affected:
4.9 , < 4.9.480
(custom)
Affected: 4.12 , < 4.12.353 (custom) Affected: 4.17 , < 4.17.333 (custom) |
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116646",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:20:06.655055Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:20:32.046Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Threat Response",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.9.480",
"status": "affected",
"version": "4.9",
"versionType": "custom"
},
{
"lessThan": "4.12.353",
"status": "affected",
"version": "4.12",
"versionType": "custom"
},
{
"lessThan": "4.17.333",
"status": "affected",
"version": "4.17",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:13:43.209Z",
"datePublic": "2026-11-03T22:12:13.371Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:14:49.643Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-097",
"url": "https://security.tanium.com/TAN-2026-097"
}
],
"title": "Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116646",
"datePublished": "2026-11-03T22:14:49.643Z",
"dateReserved": "2026-10-26T19:13:43.694Z",
"dateUpdated": "2026-11-06T19:20:32.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108311 (GCVE-0-2026-108311)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 17:02
VLAI
EPSS
VEX
Title
Tanium addressed an insufficient logging vulnerability in Tanium Server.
Summary
Tanium addressed an insufficient logging vulnerability in Tanium Server.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 17:01 UTC
CWE
- CWE-778 - Insufficient Logging
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Tanium Server |
Affected:
7.7.3 , < 7.7.3.8351
(custom)
Affected: 7.8.2 , < 7.8.2.1263 (custom) Affected: 7.8.4 , < 7.8.4.1399 (custom) |
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108311",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T17:01:18.532376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T17:02:23.864Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Tanium Server",
"vendor": "Tanium",
"versions": [
{
"lessThan": "7.7.3.8351",
"status": "affected",
"version": "7.7.3",
"versionType": "custom"
},
{
"lessThan": "7.8.2.1263",
"status": "affected",
"version": "7.8.2",
"versionType": "custom"
},
{
"lessThan": "7.8.4.1399",
"status": "affected",
"version": "7.8.4",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:27.250Z",
"datePublic": "2026-10-27T17:26:23.611Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an insufficient logging vulnerability in Tanium Server."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-778",
"description": "Insufficient Logging",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:43.548Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-078",
"url": "https://security.tanium.com/TAN-2026-078"
}
],
"title": "Tanium addressed an insufficient logging vulnerability in Tanium Server."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108311",
"datePublished": "2026-10-27T17:35:43.548Z",
"dateReserved": "2026-10-09T19:21:27.383Z",
"dateUpdated": "2026-11-04T17:02:23.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108303 (GCVE-0-2026-108303)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 20:20
VLAI
EPSS
VEX
Title
Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.
Summary
Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:06 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Certificate Manager |
Affected:
1.17 , < 1.17.417
(custom)
Affected: 1.18 , < 1.18.368 (custom) Affected: 1.22 , < 1.22.119 (custom) |
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108303",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:06:19.032715Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:20:48.211Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Certificate Manager",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.17.417",
"status": "affected",
"version": "1.17",
"versionType": "custom"
},
{
"lessThan": "1.18.368",
"status": "affected",
"version": "1.18",
"versionType": "custom"
},
{
"lessThan": "1.22.119",
"status": "affected",
"version": "1.22",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:24.393Z",
"datePublic": "2026-10-27T17:26:22.770Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an unauthorized code execution vulnerability in Certificate Manager."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:43.298Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-075",
"url": "https://security.tanium.com/TAN-2026-075"
}
],
"title": "Tanium addressed an unauthorized code execution vulnerability in Certificate Manager."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108303",
"datePublished": "2026-10-27T17:35:43.298Z",
"dateReserved": "2026-10-09T19:21:24.565Z",
"dateUpdated": "2026-11-04T20:20:48.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108316 (GCVE-0-2026-108316)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 20:20
VLAI
EPSS
VEX
Title
Tanium addressed an information disclosure vulnerability in Tanium Server.
Summary
Tanium addressed an information disclosure vulnerability in Tanium Server.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 19:32 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Tanium Server |
Affected:
7.7.3 , < 7.7.3.8351
(custom)
Affected: 7.8.2 , < 7.8.2.1263 (custom) Affected: 7.8.4 , < 7.8.4.1399 (custom) |
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108316",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T19:32:27.748721Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:20:54.089Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Tanium Server",
"vendor": "Tanium",
"versions": [
{
"lessThan": "7.7.3.8351",
"status": "affected",
"version": "7.7.3",
"versionType": "custom"
},
{
"lessThan": "7.8.2.1263",
"status": "affected",
"version": "7.8.2",
"versionType": "custom"
},
{
"lessThan": "7.8.4.1399",
"status": "affected",
"version": "7.8.4",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:29.009Z",
"datePublic": "2026-10-27T17:26:18.635Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an information disclosure vulnerability in Tanium Server."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:43.092Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-062",
"url": "https://security.tanium.com/TAN-2026-062"
}
],
"title": "Tanium addressed an information disclosure vulnerability in Tanium Server."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108316",
"datePublished": "2026-10-27T17:35:43.092Z",
"dateReserved": "2026-10-09T19:21:29.182Z",
"dateUpdated": "2026-11-04T20:20:54.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116656 (GCVE-0-2026-116656)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Title
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
Summary
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:07 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
Impacted products
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116656",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:07:53.421886Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:00.727Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Enforce",
"vendor": "Tanium",
"versions": [
{
"lessThan": "2.9.736",
"status": "affected",
"version": "2.9",
"versionType": "custom"
},
{
"lessThan": "2.10.778",
"status": "affected",
"version": "2.10",
"versionType": "custom"
},
{
"lessThan": "3.0.373",
"status": "affected",
"version": "3.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:06.278Z",
"datePublic": "2026-10-27T17:26:21.394Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an uncontrolled resource consumption vulnerability in Enforce."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:42.916Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-071",
"url": "https://security.tanium.com/TAN-2026-071"
}
],
"title": "Tanium addressed an uncontrolled resource consumption vulnerability in Enforce."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116656",
"datePublished": "2026-10-27T17:35:42.916Z",
"dateReserved": "2026-10-26T19:15:06.430Z",
"dateUpdated": "2026-11-04T20:21:00.727Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108325 (GCVE-0-2026-108325)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Title
Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.
Summary
Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:06 UTC
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Reputation |
Affected:
6.6 , < 6.6.145
(custom)
Affected: 6.7 , < 6.7.138 (custom) Affected: 6.8 , < 6.8.162 (custom) |
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108325",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:06:17.628477Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:11.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Reputation",
"vendor": "Tanium",
"versions": [
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6",
"versionType": "custom"
},
{
"lessThan": "6.7.138",
"status": "affected",
"version": "6.7",
"versionType": "custom"
},
{
"lessThan": "6.8.162",
"status": "affected",
"version": "6.8",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:32.264Z",
"datePublic": "2026-10-27T17:26:20.299Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:42.735Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-067",
"url": "https://security.tanium.com/TAN-2026-067"
}
],
"title": "Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108325",
"datePublished": "2026-10-27T17:35:42.735Z",
"dateReserved": "2026-10-09T19:21:32.389Z",
"dateUpdated": "2026-11-04T20:21:11.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116659 (GCVE-0-2026-116659)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Title
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
Summary
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 19:32 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
1 reference
Impacted products
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116659",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T19:32:26.034873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:18.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Enforce",
"vendor": "Tanium",
"versions": [
{
"lessThan": "2.9.736",
"status": "affected",
"version": "2.9",
"versionType": "custom"
},
{
"lessThan": "2.10.778",
"status": "affected",
"version": "2.10",
"versionType": "custom"
},
{
"lessThan": "3.0.373",
"status": "affected",
"version": "3.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:07.480Z",
"datePublic": "2026-10-27T17:26:23.333Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an uncontrolled resource consumption vulnerability in Enforce."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:42.543Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-077",
"url": "https://security.tanium.com/TAN-2026-077"
}
],
"title": "Tanium addressed an uncontrolled resource consumption vulnerability in Enforce."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116659",
"datePublished": "2026-10-27T17:35:42.543Z",
"dateReserved": "2026-10-26T19:15:07.631Z",
"dateUpdated": "2026-11-04T20:21:18.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108302 (GCVE-0-2026-108302)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Title
Tanium addressed an improper access controls vulnerability in Comply.
Summary
Tanium addressed an improper access controls vulnerability in Comply.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 19:32 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
Impacted products
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108302",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T19:32:24.674858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:24.560Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Comply",
"vendor": "Tanium",
"versions": [
{
"lessThan": "2.32.263",
"status": "affected",
"version": "2.32",
"versionType": "custom"
},
{
"lessThan": "2.35.323",
"status": "affected",
"version": "2.35",
"versionType": "custom"
},
{
"lessThan": "2.37.326",
"status": "affected",
"version": "2.37",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:24.023Z",
"datePublic": "2026-10-27T17:26:21.956Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper access controls vulnerability in Comply."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:42.350Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-073",
"url": "https://security.tanium.com/TAN-2026-073"
}
],
"title": "Tanium addressed an improper access controls vulnerability in Comply."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108302",
"datePublished": "2026-10-27T17:35:42.350Z",
"dateReserved": "2026-10-09T19:21:24.198Z",
"dateUpdated": "2026-11-04T20:21:24.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108306 (GCVE-0-2026-108306)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Title
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Summary
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:06 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Endpoint Configuration Toolset Solution |
Affected:
1.51 , < 1.51.60
(custom)
Affected: 1.59 , < 1.59.50 (custom) Affected: 1.71 , < 1.71.25 (custom) |
|
| Tanium | end-user-cx |
Affected:
1.8.47 , < 1.8.47
(semver)
Affected: 1.11.605 , < 1.11.605 (semver) Affected: 1.19.325 , < 1.19.325 (semver) Affected: 1.21.835 , < 1.21.835 (semver) Affected: 1.22.1199 , < 1.22.1199 (semver) Affected: 1.23.766 , < 1.23.766 (semver) Affected: 1.24.590 , < 1.24.590 (semver) |
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108306",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:06:16.233737Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:31.312Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Endpoint Configuration Toolset Solution",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.51.60",
"status": "affected",
"version": "1.51",
"versionType": "custom"
},
{
"lessThan": "1.59.50",
"status": "affected",
"version": "1.59",
"versionType": "custom"
},
{
"lessThan": "1.71.25",
"status": "affected",
"version": "1.71",
"versionType": "custom"
}
]
},
{
"product": "end-user-cx",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.8.47",
"status": "affected",
"version": "1.8.47",
"versionType": "semver"
},
{
"lessThan": "1.11.605",
"status": "affected",
"version": "1.11.605",
"versionType": "semver"
},
{
"lessThan": "1.19.325",
"status": "affected",
"version": "1.19.325",
"versionType": "semver"
},
{
"lessThan": "1.21.835",
"status": "affected",
"version": "1.21.835",
"versionType": "semver"
},
{
"lessThan": "1.22.1199",
"status": "affected",
"version": "1.22.1199",
"versionType": "semver"
},
{
"lessThan": "1.23.766",
"status": "affected",
"version": "1.23.766",
"versionType": "semver"
},
{
"lessThan": "1.24.590",
"status": "affected",
"version": "1.24.590",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:25.468Z",
"datePublic": "2026-10-27T17:26:19.759Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed a local privilege escalation vulnerability in End-User Notifications."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:42.154Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-065",
"url": "https://security.tanium.com/TAN-2026-065"
}
],
"title": "Tanium addressed a local privilege escalation vulnerability in End-User Notifications."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108306",
"datePublished": "2026-10-27T17:35:42.154Z",
"dateReserved": "2026-10-09T19:21:25.635Z",
"dateUpdated": "2026-11-04T20:21:31.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108329 (GCVE-0-2026-108329)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Title
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
Summary
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:06 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Threat Response |
Affected:
4.9 , < 4.9.476
(custom)
Affected: 4.12 , < 4.12.349 (custom) Affected: 4.17 , < 4.17.327 (custom) |
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108329",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:06:14.798317Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:37.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Threat Response",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.9.476",
"status": "affected",
"version": "4.9",
"versionType": "custom"
},
{
"lessThan": "4.12.349",
"status": "affected",
"version": "4.12",
"versionType": "custom"
},
{
"lessThan": "4.17.327",
"status": "affected",
"version": "4.17",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:33.643Z",
"datePublic": "2026-10-27T17:26:19.471Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an unauthorized code execution vulnerability in Threat Response."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:41.970Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-064",
"url": "https://security.tanium.com/TAN-2026-064"
}
],
"title": "Tanium addressed an unauthorized code execution vulnerability in Threat Response."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108329",
"datePublished": "2026-10-27T17:35:41.970Z",
"dateReserved": "2026-10-09T19:21:33.766Z",
"dateUpdated": "2026-11-04T20:21:37.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108332 (GCVE-0-2026-108332)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Title
Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.
Summary
Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:06 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Endpoint Configuration Toolset Solution |
Affected:
1.51.0 , < 1.51.60
(custom)
Affected: 1.59.0 , < 1.59.50 (custom) Affected: 1.71.0 , < 1.71.25 (custom) |
|
| Tanium | threat-response-cx |
Affected:
1.17.802 , < 1.17.802
(semver)
Affected: 1.18.2732 , < 1.18.2732 (semver) Affected: 1.19.2213 , < 1.19.2213 (semver) Affected: 1.20.2271 , < 1.20.2271 (semver) Affected: 1.21.1673 , < 1.21.1673 (semver) |
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108332",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:06:13.427552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:44.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Endpoint Configuration Toolset Solution",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.51.60",
"status": "affected",
"version": "1.51.0",
"versionType": "custom"
},
{
"lessThan": "1.59.50",
"status": "affected",
"version": "1.59.0",
"versionType": "custom"
},
{
"lessThan": "1.71.25",
"status": "affected",
"version": "1.71.0",
"versionType": "custom"
}
]
},
{
"product": "threat-response-cx",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.17.802",
"status": "affected",
"version": "1.17.802",
"versionType": "semver"
},
{
"lessThan": "1.18.2732",
"status": "affected",
"version": "1.18.2732",
"versionType": "semver"
},
{
"lessThan": "1.19.2213",
"status": "affected",
"version": "1.19.2213",
"versionType": "semver"
},
{
"lessThan": "1.20.2271",
"status": "affected",
"version": "1.20.2271",
"versionType": "semver"
},
{
"lessThan": "1.21.1673",
"status": "affected",
"version": "1.21.1673",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:34.683Z",
"datePublic": "2026-10-27T17:26:16.663Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:41.790Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-055",
"url": "https://security.tanium.com/TAN-2026-055"
}
],
"title": "Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108332",
"datePublished": "2026-10-27T17:35:41.790Z",
"dateReserved": "2026-10-09T19:21:34.846Z",
"dateUpdated": "2026-11-04T20:21:44.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108301 (GCVE-0-2026-108301)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Title
Tanium addressed an improper access controls vulnerability in Comply.
Summary
Tanium addressed an improper access controls vulnerability in Comply.
Severity
6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 19:32 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
Impacted products
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108301",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T19:32:23.271400Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:50.784Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Comply",
"vendor": "Tanium",
"versions": [
{
"lessThan": "2.32.263",
"status": "affected",
"version": "2.32",
"versionType": "custom"
},
{
"lessThan": "2.35.323",
"status": "affected",
"version": "2.35",
"versionType": "custom"
},
{
"lessThan": "2.37.326",
"status": "affected",
"version": "2.37",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-09T19:20:54.787Z",
"datePublic": "2026-10-27T17:26:20.033Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper access controls vulnerability in Comply."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:24.243Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-066",
"url": "https://security.tanium.com/TAN-2026-066"
}
],
"title": "Tanium addressed an improper access controls vulnerability in Comply."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108301",
"datePublished": "2026-10-27T17:35:24.243Z",
"dateReserved": "2026-10-09T19:20:55.306Z",
"dateUpdated": "2026-11-04T20:21:50.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}