{"id":"CVE-2026-116650","kind":"vulnerability","aliases":["CVE-2026-116650"],"related":[],"title":"Tanium Threat Response: authenticated user can run unauthorized code on endpoints via Linux quarantine package","description":"Tanium addressed an unauthorized code execution vulnerability in Threat Response.","summary":"Tanium bulletin TAN-2026-095 (CVSS 7.5, AV:N/AC:H/PR:L): an authenticated Tanium user with the Threat Response write permission could execute unauthorized code on endpoints running the Linux quarantine package. Fixed in Threat Response 4.9.480, 4.12.353 and 4.17.333. Tanium lists no workaround. No exploitation or PoC noted in the sources.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Threat Response","fixed":["4.9.480","4.12.353","4.17.333"],"affected":">= 4.9, < 4.9.480; >= 4.12, < 4.12.353; >= 4.17, < 4.17.333","ecosystem":"vendor"}],"ecosystems":[],"tags":["endpoint-security","linux","tanium","threat-response","vendor"],"not_affected_if":["auth-required"],"how_to_check":"In the Tanium console check the installed Threat Response version. Affected: 4.9 to before 4.9.480 (2025H1), 4.12 to before 4.12.353 (2025H2), 4.17 to before 4.17.333 (2026H1). Also see which users hold the Threat Response write permission, and whether Linux endpoints use the quarantine package.","fix":"Update Threat Response to Update 27 (v4.9.480), Update 17 (v4.12.353) or Update 10 (v4.17.333), or later, matching your release train.","status":"open","published_at":"2026-11-03T23:17:30+00:00","first_seen_at":"2026-11-03T23:45:13+00:00","triaged_at":"2026-11-03T23:45:31+00:00","updated_at":"2026-11-03T23:47:45+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-03T23:45:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Tanium Threat Response: unauthorized code execution flaw, patched by vendor","impact":"high","summary":"Tanium Threat Response contains a flaw that allows unauthorized code execution, according to the NVD entry. The sources do not describe the attack path or which versions are affected.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["tanium","threat-response","endpoint-security"],"confidence":0.35,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized code execution on systems running Threat Response","analyst_note":"Find the Tanium advisory and affected version ranges; check https://nvd.nist.gov/vuln/detail/CVE-2026-116650 for the CVSS vector and attack vector.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000592,"input_tokens":4042,"output_tokens":375,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Tanium advisory and affected version ranges; check https://nvd.nist.gov/vuln/detail/CVE-2026-116650 for the CVSS vector and attack vector.","search":"'-095':37B '-116650':18A,21A '-2026':17A,20A,36B '4.12.353':70B '4.17.333':72B '4.9.480':69B '7.5':39B 'address':86C 'authent':4A,45B 'av':40B 'bulletin':34B 'code':9A,57B,89C 'could':54B 'cve':16A,19A 'cvss':38B 'endpoint':11A,25B,59B 'endpoint-secur':24B 'execut':55B,90C 'exploit':78B 'fix':65B 'h/pr':42B 'l':43B 'linux':13A,27B,62B 'list':74B 'n/ac':41B 'note':81B 'packag':15A,64B 'permiss':53B 'poc':80B 'quarantin':14A,63B 'respons':3A,31B,51B,68B,94C 'response':23A 'run':7A,60B 'secur':26B 'sourc':84B 'tan':35B 'tanium':1A,28B,33B,46B,73B,85C 'threat':2A,22A,30B,50B,67B,93C 'threat-respons':29B 'unauthor':8A,56B,88C 'user':5A,47B 'vendor':32B 'via':12A 'vulner':91C 'workaround':76B 'write':52B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Tanium Threat Response on the 2025H1, 2025H2 or 2026H1 release trains below the fixed updates. The attacker must already be an authenticated Tanium user with the Threat Response write permission, and the code runs on endpoints using the Linux quarantine package. Teams not running Threat Response, or already on the fixed updates, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T23:47:45Z","by":"analyst","doc":"https://security.tanium.com/TAN-2026-095","run_id":1582},"products":{"at":"2026-11-03T23:47:45Z","by":"analyst","doc":"https://security.tanium.com/TAN-2026-095","run_id":1582},"how_to_check":{"at":"2026-11-03T23:47:45Z","by":"analyst","doc":"https://security.tanium.com/TAN-2026-095","run_id":1582}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["response","threatresponse"],"ptokens":["response","threat"],"labels":["endpointsecurity","high","linux","tanium","threatresponse","vendor"],"campaign_type":null,"first_public_at":"2026-11-03T23:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"3938794e-25f5-4123-a1ba-5cbd7f104512","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116650","severity":null,"published_at":"2026-11-03T23:17:30+00:00","modified_at":"2026-11-03T23:17:30+00:00","first_seen_at":"2026-11-03T23:45:13+00:00","fetched_at":"2026-11-03T23:45:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116650:1582","url":null,"severity":null,"published_at":"2026-11-03T23:47:45+00:00","modified_at":"2026-11-03T23:47:45+00:00","first_seen_at":"2026-11-03T23:47:45+00:00","fetched_at":"2026-11-03T23:47:45+00:00","note":"Vendor bulletin TAN-2026-095 matches: CVE record (via HOL aggregator) cites it, and ranges match. Vendor page does not print the CVE id; sibling TAN-2026-088 (SSH Known Hosts sensor) has identical score/ranges, so impact text is from 095 per CVE reference. who_affected left unverified for that reason. NVD page unreadable."}],"documents":[{"id":61714,"url":"https://security.tanium.com/TAN-2026-095","title":"TAN-2026-095 Tanium Security Bulletin (Threat Response)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":61715,"url":"https://hol.org/guard/security/cves/CVE-2026-116650-tanium-addressed-an-unauthorized-code-execution","title":"HOL Guard record CVE-2026-116650 (cites TAN-2026-095)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}