Tanium End-User Notifications: Local privilege escalation via link following
Summary
Tanium End-User Notifications, a shared component used by Tanium endpoint products, contains a local privilege escalation vulnerability. A user with a low-privilege account on an endpoint running the Tanium Client can exploit a privileged file operation that follows a link in a user-controlled location to gain elevated rights. The CVSS score is 7.8 (high) with no user interaction required, but the attacker must already have local access.
Affected
- Endpoint Configuration Toolset Solution 1.51 to before 1.51.60 (2025H1 release, before Update 26)
- Endpoint Configuration Toolset Solution 1.59 to before 1.59.50 (2025H2 release, before Update 16)
- Endpoint Configuration Toolset Solution 1.71 to before 1.71.25 (2026H1 release, before Update 9)
- end-user-cx 1.8 before 1.8.47, 1.11 before 1.11.605, 1.19 before 1.19.325, 1.21 before 1.21.835, 1.22 before 1.22.1199, 1.23 before 1.23.766, 1.24 before 1.24.590
- Affected ranges for end-user-cx in the CVE record are unverified.
Fixed in
- Endpoint Configuration Toolset Solution Update 26 (1.51.60), Update 16 (1.59.50) and Update 9 (1.71.25) or later
- end-user-cx 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 and 1.24.590 or later (per Strix, to be verified against the vendor advisory)
Workaround
- Vendor lists no workaround or mitigation beyond upgrading.
- Interim Endpoint Configuration manifests may be deployed via Change Management; manifest versions are unverified and should be checked against the Tanium advisory.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV.
- No public proof of concept found.
Our recommendation
- Check whether Tanium Endpoint Configuration or end-user-cx is deployed in your environment or at your managed service provider.
- Upgrade to the fixed versions listed above and verify the versions in the Tanium advisory TAN-2026-061.
- Prioritise multi-user systems such as terminal servers, shared workstations and kiosks.
- Restrict local logon on shared endpoints and review local accounts.
- Monitor endpoints for unexpected privilege changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Tanium Security Bulletin TAN-2026-061 security.tanium.com
- OffSeq Radar: CVE-2026-108305 radar.offseq.com
- Strix: CVE-2026-108305 www.strix.ai
- CNNVD mirror (vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:06.
Original description (NVD)
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.