---
id: "CVE-2026-116650"
kind: "vulnerability"
aliases: ["CVE-2026-116650"]
title: "Tanium Threat Response: authenticated user can run unauthorized code on endpoints via Linux quarantine package"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Threat Response", "fixed": ["4.9.480", "4.12.353", "4.17.333"], "affected": ">= 4.9, < 4.9.480; >= 4.12, < 4.12.353; >= 4.17, < 4.17.333", "ecosystem": "vendor"}]
ecosystems: []
tags: ["endpoint-security", "linux", "tanium", "threat-response", "vendor"]
not_affected_if: ["auth-required"]
published_at: "2026-11-03T23:17:30+00:00"
first_seen_at: "2026-11-03T23:45:13+00:00"
updated_at: "2026-11-03T23:47:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116650", "first_seen_at": "2026-11-03T23:45:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T23:47:45+00:00"}]
---

# Tanium Threat Response: authenticated user can run unauthorized code on endpoints via Linux quarantine package

Tanium bulletin TAN-2026-095 (CVSS 7.5, AV:N/AC:H/PR:L): an authenticated Tanium user with the Threat Response write permission could execute unauthorized code on endpoints running the Linux quarantine package. Fixed in Threat Response 4.9.480, 4.12.353 and 4.17.333. Tanium lists no workaround. No exploitation or PoC noted in the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Threat Response affected >= 4.9, < 4.9.480; >= 4.12, < 4.12.353; >= 4.17, < 4.17.333 fixed 4.9.480, 4.12.353, 4.17.333

## How to check

In the Tanium console check the installed Threat Response version. Affected: 4.9 to before 4.9.480 (2025H1), 4.12 to before 4.12.353 (2025H2), 4.17 to before 4.17.333 (2026H1). Also see which users hold the Threat Response write permission, and whether Linux endpoints use the quarantine package.

## Fix

Update Threat Response to Update 27 (v4.9.480), Update 17 (v4.12.353) or Update 10 (v4.17.333), or later, matching your release train.

## Timeline

- 2026-11-03T23:45:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116650
- 2026-11-03T23:47:45+00:00 analyst — Vendor bulletin TAN-2026-095 matches: CVE record (via HOL aggregator) cites it, and ranges match. Vendor page does not print the CVE id; sibling TAN-2026-088 (SSH Known Hosts sensor) has identical score/ranges, so impact text is from 095 per CVE reference. who_affected left unverified for that reason. NVD page unreadable.

## Documents

- [advisory] TAN-2026-095 Tanium Security Bulletin (Threat Response) https://security.tanium.com/TAN-2026-095
- [mentions] HOL Guard record CVE-2026-116650 (cites TAN-2026-095) https://hol.org/guard/security/cves/CVE-2026-116650-tanium-addressed-an-unauthorized-code-execution

## From the sources

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_