{"id":"CVE-2026-108313","kind":"vulnerability","aliases":["CVE-2026-108313"],"related":[],"title":"Tanium Server: incorrect privilege assignment lets low-privilege users gain rights","description":"Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server.","summary":"Tanium Server had an incorrect privilege assignment flaw, which the vendor has addressed. The sources do not say which privileges an attacker gains or what preconditions apply.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["self-hosted","tanium","vendor","windows"],"not_affected_if":["not-running-tanium"],"how_to_check":"- Compare the installed Tanium Server version against the fixed version in Tanium's advisory (unknown in these sources)\n- Check the Tanium Server version in the Tanium console or on the server host (unknown in these sources)","fix":"- Update Tanium Server to the version Tanium lists as fixed (unknown in these sources)\n- Check the Tanium security advisory for the exact patched build (unknown in these sources)","status":"open","published_at":"2026-10-27T18:17:32+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","triaged_at":"2026-10-27T18:34:46+00:00","updated_at":"2026-10-27T18:34:46+00:00","category":"vendor","confidence":0.3,"triage":{"at":"2026-10-27T18:34:46Z","model":"claude-haiku-5-5","output":{"fix":"- Update Tanium Server to the version Tanium lists as fixed (unknown in these sources)\n- Check the Tanium security advisory for the exact patched build (unknown in these sources)","reach":"unknown","title":"Tanium Server: incorrect privilege assignment lets low-privilege users gain rights","impact":"medium","summary":"Tanium Server had an incorrect privilege assignment flaw, which the vendor has addressed. The sources do not say which privileges an attacker gains or what preconditions apply.","category":"vendor","nicknames":[],"who_cares":["tanium","self-hosted","windows"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown privilege gain on the Tanium Server","analyst_note":"Find Tanium's advisory for CVE-2026-108313 to confirm affected and fixed versions, required privileges, and the exact privilege gained.","how_to_check":"- Compare the installed Tanium Server version against the fixed version in Tanium's advisory (unknown in these sources)\n- Check the Tanium Server version in the Tanium console or on the server host (unknown in these sources)","needs_analyst":true,"not_affected_if":["not-running-tanium"],"who_is_affected":"Organizations running Tanium Server on a version before the vendor's fix. The sources do not say which versions are affected or which roles can exploit the flaw. Teams with no Tanium Server deployment can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000593,"input_tokens":3241,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108313':15A,18A '-2026':14A,17A 'address':37B,53C 'appli':51B 'assign':5A,31B,57C 'attack':46B 'cve':13A,16A 'flaw':32B 'gain':11A,47B 'host':21B 'incorrect':3A,29B,55C 'let':6A 'low':8A 'low-privileg':7A 'precondit':50B 'privileg':4A,9A,30B,44B,56C 'right':12A 'say':42B 'self':20B 'self-host':19B 'server':2A,26B,61C 'sourc':39B 'tanium':1A,22B,25B,52C,60C 'user':10A 'vendor':23B,35B 'vulner':58C 'window':24B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Tanium Server on a version before the vendor's fix. The sources do not say which versions are affected or which roles can exploit the flaw. Teams with no Tanium Server deployment can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"3938794e-25f5-4123-a1ba-5cbd7f104512","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108313","severity":null,"published_at":"2026-10-27T18:17:32+00:00","modified_at":"2026-10-27T18:17:32+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","fetched_at":"2026-10-27T18:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}