Read the docs
TI-2026-81476 Aliases CVE-2026-108332GHSA-x2fp-vv8c-cc8h

Improper link resolution in Tanium Threat Response Client Extension

Priority LOW 29CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Tanium Endpoint Configuration Toolset Solution from 1.51.0 before 1.51.60, from 1.59.0 before 1.59.50 and from 1.71.0 before 1.71.25 is affected. Improper link resolution (CWE-59) lets a local attacker redirect file access before a file is opened. A local attacker with low privileges can affect the confidentiality and integrity of files, though the attack is highly complex.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00149 4th percentileScored 2026-11-07
Fix Fixed Endpoint Configuration Toolset Solution (Tanium): 1.51.60, 1.59.50, 1.71.25threat-response-cx (Tanium): 1.17.802, 1.18.2732, 1.19.2213 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TaniumEndpoint Configuration Toolset Solution1.51.0 to before 1.51.60; 1.59.0 to before 1.59.50; 1.71.0 to before 1.71.251.51.60, 1.59.50, 1.71.25Patch availableCNA
Taniumthreat-response-cx1.17.802 to before 1.17.802; 1.18.2732 to before 1.18.2732; 1.19.2213 to before 1.19.2213; 1.20.2271 to before 1.20.2271; 1.21.1673 to before 1.21.16731.17.802, 1.18.2732, 1.19.2213, 1.20.2271, 1.21.1673Patch availableCNA
  • Endpoint Configuration Toolset Solution VendorTanium Affected 1.51.0 to before 1.51.60; 1.59.0 to before 1.59.50; 1.71.0 to before 1.71.25 Fixed in 1.51.60, 1.59.50, 1.71.25 Patch available CNA
  • threat-response-cx VendorTanium Affected 1.17.802 to before 1.17.802; 1.18.2732 to before 1.18.2732; 1.19.2213 to before 1.19.2213; 1.20.2271 to before 1.20.2271; 1.21.1673 to before 1.21.1673 Fixed in 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271, 1.21.1673 Patch available CNA

Remediation

Upgrade Endpoint Configuration Toolset Solution to 1.51.60, 1.59.50 or 1.71.25. Upgrade threat-response-cx to 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271 or 1.21.1673.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Endpoint Configuration Toolset Solution (Tanium) Fixed in 1.51.60, 1.59.50, 1.71.25
  • Fix · CNA threat-response-cx (Tanium) Fixed in 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271, 1.21.1673

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Tanium Endpoint Configuration Toolset Solution 1.51.60, 1.59.50, 1.71.25

    10 records Highest priority Priority LOW 10 LOW

    Other records, highest priority first

    • TI-2026-81463 Heap-based buffer overflow in Tanium IndexPriority LOW 35
    • TI-2026-81462 Local privilege escalation in Tanium End-User NotificationsPriority LOW 35
    • TI-2026-81461 Local privilege escalation in Tanium End-User NotificationsPriority LOW 35
    Show all 10 records →
  • Release ·

    Tanium threat-response-cx 1.17.802, 1.18.2732 and 3 more versions

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-81474 Information disclosure in Tanium Threat Response Client ExtensionPriority LOW 16
    • TI-2026-81475 Uncontrolled recursion in Tanium Threat Response Client ExtensionPriority LOW 15
    • TI-2026-81477 Use-after-free flaw in Tanium Threat Response Client ExtensionPriority LOW 12
    Show all 4 records →

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-108332
  2. 2026-10-27 Alias added: GHSA-x2fp-vv8c-cc8h
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-11-04 CISA SSVC decision points changed

References

Other 1

  • TI-2026-81473 Unauthorized code execution in Tanium Threat Response CVSS 3.1HIGH 8.8
  • TI-2026-81459 Tanium Certificate Manager unauthorized code execution vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-59476 Tanium addressed a SQL injection vulnerability in Threat Response. CVSS 3.1HIGH 8.8
  • TI-2026-08094 Tanium addressed an unauthorized code execution vulnerability in Connect. CVSS 3.1HIGH 8.8
  • TI-2026-08093 Tanium addressed an unauthorized code execution vulnerability in Connect. CVSS 3.1HIGH 8.8
  • TI-2025-13983 Tanium addressed an improper input validation vulnerability in Deploy. CVSS 3.1HIGH 8.8
See all 135 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences