Live › vulnerability › CVE-2026-116650
Tanium bulletin TAN-2026-095 (CVSS 7.5, AV:N/AC:H/PR:L): an authenticated Tanium user with the Threat Response write permission could execute unauthorized code on endpoints running the Linux quarantine package. Fixed in Threat Response 4.9.480, 4.12.353 and 4.17.333. Tanium lists no workaround. No exploitation or PoC noted in the sources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Organizations running Tanium Threat Response on the 2025H1, 2025H2 or 2026H1 release trains below the fixed updates. The attacker must already be an authenticated Tanium user with the Threat Response write permission, and the code runs on endpoints using the Linux quarantine package. Teams not running Threat Response, or already on the fixed updates, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Threat Response | vendor | >= 4.9, < 4.9.480; >= 4.12, < 4.12.353; >= 4.17, < 4.17.333 | 4.9.480, 4.12.353, 4.17.333 |
4.9.480 (2025H1), 4.12 to before 4.12.353 (2025H2), 4.17 to before (2026H1)4.17.333Update Threat Response to Update 27 (v4.9.480), Update 17 (v4.12.353) or Update 10 (v4.17.333), or later, matching your release train.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
This page as .md · .json · in your agent: get_signal("CVE-2026-116650")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.