{"id":"CVE-2026-108329","kind":"vulnerability","aliases":["CVE-2026-108329"],"related":[],"title":"Tanium Threat Response: unauthorized code execution flaw, patched by vendor","description":"Tanium addressed an unauthorized code execution vulnerability in Threat Response.","summary":"Command injection (CWE-77) in Tanium Threat Response: an authenticated Tanium user with the Read Sensor permission can run unauthorized code on endpoints running the Mac Downloaded Files sensor. CVSS 8.8. Fixed in 4.9.476, 4.12.349, 4.17.327. No workaround.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Threat Response","fixed":["4.9.476","4.12.349","4.17.327"],"affected":">= 4.9, < 4.9.476; >= 4.12, < 4.12.349; >= 4.17, < 4.17.327","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","endpoint-security","macos","other","self-hosted","tanium","threat-response"],"not_affected_if":["no-mac-endpoints"],"how_to_check":"In the Tanium console, check the installed Threat Response version: affected if 4.9 < 4.9.476, 4.12 < 4.12.349 or 4.17 < 4.17.327. Also check whether the Mac Downloaded Files sensor is used on macOS endpoints and who holds Read Sensor.","fix":"Update Threat Response to Update 26 (4.9.476), Update 16 (4.12.349) or Update 9 (4.17.327), or later. Vendor lists no workarounds.","status":"open","published_at":"2026-10-27T18:17:33+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","triaged_at":"2026-10-27T18:34:24+00:00","updated_at":"2026-10-27T18:36:36+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-27T18:34:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Tanium Threat Response: unauthorized code execution flaw, patched by vendor","impact":"high","summary":"Tanium Threat Response contains a flaw that allows unauthorized code execution, according to the vendor-addressed NVD record. The sources do not describe the attack path or the required privileges.","category":"other","nicknames":[],"who_cares":["tanium","threat-response","endpoint-security"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker runs unauthorized code on affected Threat Response systems","analyst_note":"Find the Tanium advisory for CVE-2026-108329 to get affected versions, fixed versions, attack vector and privileges required; NVD link: https://nvd.nist.gov/vuln/detail/CVE-2026-108329","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00051,"input_tokens":3234,"output_tokens":374,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Tanium advisory for CVE-2026-108329 to get affected versions, fixed versions, attack vector and privileges required; NVD link: https://nvd.nist.gov/vuln/detail/CVE-2026-108329","search":"'-108329':13A,16A '-2026':12A,15A '-77':37B '4.12.349':68B '4.17.327':69B '4.9.476':67B '8.8':64B 'address':73C 'authent':43B 'code':5A,54B,76C 'command':20B,34B 'command-inject':19B 'cve':11A,14A 'cvss':63B 'cwe':36B 'download':60B 'endpoint':23B,56B 'endpoint-secur':22B 'execut':6A,77C 'file':61B 'fix':65B 'flaw':7A 'host':29B 'inject':21B,35B 'mac':59B 'maco':25B 'patch':8A 'permiss':50B 'read':48B 'respons':3A,33B,41B,81C 'response':18A 'run':52B,57B 'secur':24B 'self':28B 'self-host':27B 'sensor':49B,62B 'tanium':1A,30B,39B,44B,72C 'threat':2A,17A,32B,40B,80C 'threat-respons':31B 'unauthor':4A,53B,75C 'user':45B 'vendor':10A 'vulner':78C 'workaround':71B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{"fix":{"at":"2026-10-27T18:36:36Z","by":"analyst","run_id":915},"workarounds":{"at":"2026-10-27T18:36:36Z","by":"analyst","run_id":915},"how_to_check":{"at":"2026-10-27T18:36:36Z","by":"analyst","run_id":915},"who_affected":{"at":"2026-10-27T18:36:36Z","by":"analyst","run_id":915}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"3938794e-25f5-4123-a1ba-5cbd7f104512","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108329","severity":null,"published_at":"2026-10-27T18:17:33+00:00","modified_at":"2026-10-27T18:17:33+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","fetched_at":"2026-10-27T18:32:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-108329:915","url":null,"severity":null,"published_at":"2026-10-27T18:36:36+00:00","modified_at":"2026-10-27T18:36:36+00:00","first_seen_at":"2026-10-27T18:36:36+00:00","fetched_at":"2026-10-27T18:36:36+00:00","note":"Read Tanium TAN-2026-064 (primary) and NVD; no exploitation or PoC checked beyond advisory; no social search (low profile)."}],"documents":[{"id":7381,"url":"https://security.tanium.com/TAN-2026-064","title":"TAN-2026-064 Tanium Threat Response","kind":"advisory","source":"analyst","text":"Authenticated Tanium user with Read Sensor permission could execute unauthorized code on endpoints running the Mac Downloaded Files sensor. CVSS 8.8 AV:N/AC:L/PR:L/UI:N. Fixed: 4.9.476 (Update 26), 4.12.349 (Update 16), 4.17.327 (Update 9). Workarounds: none.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":7382,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108329","title":"NVD CVE-2026-108329","kind":"other","source":"analyst","text":"CWE-77 command injection, CNA Tanium CVSS 8.8. Threat Response 4.9<4.9.476, 4.12<4.12.349, 4.17<4.17.327.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}