Tanium Threat Response: Unauthorized code execution vulnerability

Summary

Tanium Threat Response versions before 4.9.476, 4.12.349 and 4.17.327 contain a flaw that allows unauthorized code execution. According to the vendor advisory, an authenticated user with the Read Sensor permission can execute code on endpoints running the Mac Downloaded Files sensor. Exploitation requires a valid low-privilege account but no user interaction, and the CVSS base score is 8.8 (High). NVD analysis was still pending at the time of writing.

Affected

• Tanium Threat Response 4.9 to before 4.9.476 (2025H1 release)
• Tanium Threat Response 4.12 to before 4.12.349 (2025H2 release)
• Tanium Threat Response 4.17 to before 4.17.327 (2026H1 release)

Fixed in

• Threat Response 4.9.476 (2025H1 Update 26) and later
• Threat Response 4.12.349 (2025H2 Update 16) and later
• Threat Response 4.17.327 (2026H1 Update 9) and later

Workaround

None documented by the vendor.

Exploitation

• No evidence of active exploitation known at the time of writing.
• Not listed in CISA KEV; no public proof-of-concept exploit known.
• EPSS: 0.5 % (percentile 43).

Our recommendation

• Confirm the installed Threat Response version and compare it with the fixed versions listed above.
• Apply the vendor update on the next maintenance window, or sooner if the console is reachable from untrusted networks.
• Review Threat Response accounts and remove unneeded accounts, especially those with the Read Sensor permission.
• Check the Tanium advisory TAN-2026-064 and the NVD record once analysis is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Tanium Security Bulletin TAN-2026-064 security.tanium.com
• VulDB entry 427498 vuldb.com
• OffSeq Radar threat entry radar.offseq.com
• Strix CVE entry www.strix.ai
• CVE record (threatint mirror) cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:10.