{"id":"CVE-2026-108305","kind":"vulnerability","aliases":["CVE-2026-108305"],"related":[],"title":"Tanium End-User Notifications: local privilege escalation to higher system rights","description":"Tanium addressed a local privilege escalation vulnerability in End-User Notifications.","summary":"Tanium End-User Notifications (end-user-cx tool) local privilege escalation: a privileged file operation follows a link in a user-controlled location, so a local low-privilege user on a machine running the Tanium Client can gain SYSTEM-level rights. CVSS 7.8. Fixed through Endpoint Configuration Toolset Solution updates plus a Manifest deployment.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Tanium End-User Notifications (end-user-cx)","fixed":["1.8.47","1.11.605","1.19.325","1.21.835","1.22.1199","1.23.766","1.24.590"],"affected":"1.8 < 1.8.47; 1.11 < 1.11.605; 1.19 < 1.19.325; 1.21 < 1.21.835; 1.22 < 1.22.1199; 1.23 < 1.23.766; 1.24 < 1.24.590","ecosystem":"vendor"}],"ecosystems":[],"tags":["end-user-notifications","endpoint-configuration","local-privilege-escalation","tanium","tanium-client","vendor","windows"],"not_affected_if":[],"how_to_check":"In Tanium, check the Endpoint Configuration Toolset Solution version and the end-user-cx tool version on endpoints. Vulnerable: end-user-cx 1.8 < 1.8.47, 1.11 < 1.11.605, 1.19 < 1.19.325, 1.21 < 1.21.835, 1.22 < 1.22.1199, 1.23 < 1.23.766, 1.24 < 1.24.590; or ECT Solution < v1.51.60 (2025H1), < v1.59.50 (2025H2), < v1.71.25 (2026H1).","fix":"Update Endpoint Configuration Toolset Solution to Update 26 (v1.51.60), Update 16 (v1.59.50) or Update 9 (v1.71.25) or later for your release. Then deploy via ECM Change Management a Manifest: on-prem 2.13.327 / 2.21.324 / 2.35.252 or later; Tanium Cloud 2.40.197 / 2.42.152 / 2.44.102 / 2.46.75 or later. No workaround.","status":"open","published_at":"2026-10-27T18:17:32+00:00","first_seen_at":"2026-10-27T18:32:58+00:00","triaged_at":"2026-10-27T18:34:32+00:00","updated_at":"2026-10-27T18:37:14+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-27T18:34:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Tanium End-User Notifications: local privilege escalation to higher system rights","impact":"high","summary":"Tanium End-User Notifications has a local privilege escalation flaw, which lets a user already on the machine gain higher privileges. The sources give a CVSS score of 7.8 but do not describe the exact trigger or the affected versions.","category":"vendor","nicknames":[],"who_cares":["tanium","end-user-notifications","windows"],"confidence":0.5,"needs_auth":"yes","worst_case":"A local user gains elevated system privileges on the endpoint","analyst_note":"Find Tanium's advisory for CVE-2026-108305 to get affected and fixed versions and the required configuration.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000494,"input_tokens":3236,"output_tokens":341,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Tanium's advisory for CVE-2026-108305 to get affected and fixed versions and the required configuration.","search":"'-108305':15A,18A '-2026':14A,17A '7.8':92B 'address':105C 'client':42B,84B 'configur':34B,96B 'control':69B 'cve':13A,16A 'cvss':91B 'cx':27A,53B 'deploy':103B 'end':3A,21A,25A,29B,47B,51B,113C 'end-us':2A,46B,112C 'end-user':20A 'end-user-cx':24A,50B 'end-user-notif':28B 'endpoint':33B,95B 'endpoint-configur':32B 'escal':8A,38B,57B,109C 'file':60B 'fix':93B 'follow':62B 'gain':86B 'higher':10A 'level':89B 'link':64B 'local':6A,36B,55B,73B,107C 'local-privilege-escal':35B 'locat':70B 'low':75B 'low-privileg':74B 'machin':80B 'manifest':102B 'notif':5A,31B,49B,115C 'notifications':23A 'oper':61B 'plus':100B 'privileg':7A,37B,56B,59B,76B,108C 'right':12A,90B 'run':81B 'solut':98B 'system':11A,88B 'system-level':87B 'tanium':1A,19A,39B,41B,45B,83B,104C 'tanium-cli':40B 'tool':54B 'toolset':97B 'updat':99B 'user':4A,22A,26A,30B,48B,52B,68B,77B,114C 'user-control':67B 'vendor':43B 'vulner':110C 'window':44B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"3938794e-25f5-4123-a1ba-5cbd7f104512","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108305","severity":null,"published_at":"2026-10-27T18:17:32+00:00","modified_at":"2026-10-27T18:17:32+00:00","first_seen_at":"2026-10-27T18:32:58+00:00","fetched_at":"2026-10-27T18:32:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-108305:917","url":null,"severity":null,"published_at":"2026-10-27T18:37:14+00:00","modified_at":"2026-10-27T18:37:14+00:00","first_seen_at":"2026-10-27T18:37:14+00:00","fetched_at":"2026-10-27T18:37:14+00:00","note":"Tanium published three identical End-User Notifications LPE bulletins on 2026-10-27 (TAN-2026-058/061/065); none cites a CVE id, so I could not tell which one is CVE-2026-108305. Versions are identical across all three, so fix info holds either way. Linked as mentions, nothing marked verified. Searching the CVE id found nothing else; NVD page did not load. No public exploit or discussion found."}],"documents":[{"id":7385,"url":"https://security.tanium.com/TAN-2026-058/","title":"TAN-2026-058 Tanium: LPE in End-User Notifications","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":7386,"url":"https://security.tanium.com/TAN-2026-061/","title":"TAN-2026-061 Tanium: LPE in End-User Notifications","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":7387,"url":"https://security.tanium.com/TAN-2026-065/","title":"TAN-2026-065 Tanium: LPE in End-User Notifications","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}