Live › vulnerability › CVE-2026-116651
Command injection (CWE-78) in Tanium Threat Response. Per Tanium bulletin TAN-2026-088, an authenticated Tanium user with the Threat Response User and Interact Read-Only User roles could execute unauthorized code on endpoints running the SSH Known Hosts sensor. CVSS 7.5 (AC:H). Fixed in 4.9.480, 4.12.353, 4.17.333. No workaround. No exploitation reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Self-hosted Tanium deployments running Threat Response below 4.9.480, 4.12.353 or 4.17.333. An attacker needs a Tanium account with the Threat Response User and Interact Read-Only User roles, and the code runs on endpoints with the SSH Known Hosts sensor. Teams without Threat Response can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Threat Response | vendor | >= 4.9, < 4.9.480; >= 4.12, < 4.12.353; >= 4.17, < 4.17.333 | 4.9.480, 4.12.353, 4.17.333 |
4.9.480, 4.12 < 4.12.353 or 4.17 < 4.17.3334.9.480), Update 17 (4.12.353) or Update 10 (4.17.333), or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
This page as .md · .json · in your agent: get_signal("CVE-2026-116651")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.