How do I check whether I am affected by CVE-2026-108329?

In the Tanium console, check the installed Threat Response version: affected if 4.9 < 4.9.476, 4.12 < 4.12.349 or 4.17 < 4.17.327. Also check whether the Mac Downloaded Files sensor is used on macOS endpoints and who holds Read Sensor.

What is the fix for CVE-2026-108329?

Update Threat Response to Update 26 (4.9.476), Update 16 (4.12.349) or Update 9 (4.17.327), or later. Vendor lists no workarounds.

Who is not affected by CVE-2026-108329?

Not affected if: no-mac-endpoints.

Live › vulnerability › CVE-2026-108329

Go to dashboard

high8.8Other

Tanium Threat Response: unauthorized code execution flaw, patched by vendor

Q: What is the fix for CVE-2026-108329?

Update Threat Response to Update 26 (4.9.476), Update 16 (4.12.349) or Update 9 (4.17.327), or later. Vendor lists no workarounds.

Q: Who is not affected by CVE-2026-108329?

Not affected if: no-mac-endpoints.

Command injection (CWE-77) in Tanium Threat Response: an authenticated Tanium user with the Read Sensor permission can run unauthorized code on endpoints running the Mac Downloaded Files sensor. CVSS 8.8. Fixed in 4.9.476, 4.12.349, 4.17.327. No workaround.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by 3938794e-25f5-4123-a1ba-5cbd7f104512

known so far5 of 6

missing: exploitation

First public: Oct 27, 2026 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-27 18:32 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker runs unauthorized code on affected Threat Response systems.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-108329

Go to dashboard

high8.8Other

Tanium Threat Response: unauthorized code execution flaw, patched by vendor

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by 3938794e-25f5-4123-a1ba-5cbd7f104512

known so far5 of 6

missing: exploitation

First public: Oct 27, 2026 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-27 18:32 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker runs unauthorized code on affected Threat Response systems.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Tanium Threat Response: unauthorized code execution flaw, patched by vendor

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Tanium Threat Response: unauthorized code execution flaw, patched by vendor

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources