Tanium Endpoint Configuration Toolset: Local privilege escalation in End-User Notifications

Summary

A local privilege escalation vulnerability in Tanium End-User Notifications affects the Endpoint Configuration Toolset Solution and the end-user-cx tool. An attacker with a low-privileged local account on a system running the Tanium Client can gain higher privileges when a privileged file operation follows a link in a user-controlled location. The CNA rates the issue 7.8 (High); NVD analysis is still pending.

Affected

• Endpoint Configuration Toolset Solution 1.51 to before 1.51.60, 1.59 to before 1.59.50, 1.71 to before 1.71.25 (per the CVE record)
• end-user-cx before 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 and 1.24.590 (per the vendor advisory excerpt)
• Lower bounds for end-user-cx: unknown, as the aggregator ranges are malformed.

Fixed in

• Endpoint Configuration Toolset Solution: Update 26 (v1.51.60), Update 16 (v1.59.50), Update 9 (v1.71.25) and later
• end-user-cx: 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766, 1.24.590 and later

Workaround

• None, according to the vendor advisory TAN-2026-058.
• Tanium on-prem customers using ECM: deploy one of the listed Change Management manifests (2.13.327, 2.21.324 or 2.35.252 or later) in addition to upgrading. These manifest numbers are unverified and must be checked against the vendor advisory.
• Tanium Cloud customers using ECM: manifest versions listed in the advisory, to be verified before use.

Exploitation

• Not known to be exploited in the wild.
• Not listed in CISA KEV.
• No public proof-of-concept exploit known.

Our recommendation

• Check whether any endpoint runs Tanium Endpoint Configuration Toolset Solution or end-user-cx and identify the installed versions.
• Verify the affected and fixed versions in Tanium advisory TAN-2026-058 before acting.
• Upgrade affected components to the fixed versions and, for ECM users, deploy the manifests listed by the vendor after verification.
• Restrict local logon and low-privileged accounts where possible and monitor endpoints for suspicious file link activity.
• If Tanium is not used, no action is needed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Tanium Security Bulletin TAN-2026-058 security.tanium.com
• CVE record data release (CVE Program) github.com
• Strix CVE-2026-108304 (aggregator) www.strix.ai
• Offseq threat page CVE-2026-108304 radar.offseq.com
• Canadian Cyber Centre summary via Mallory mallory.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:08.