{"id":"CVE-2026-116651","kind":"vulnerability","aliases":["CVE-2026-116651"],"related":[],"title":"Tanium Threat Response: authenticated user can run code on endpoints via SSH Known Hosts sensor","description":"Tanium addressed an unauthorized code execution vulnerability in Threat Response.","summary":"Command injection (CWE-78) in Tanium Threat Response. Per Tanium bulletin TAN-2026-088, an authenticated Tanium user with the Threat Response User and Interact Read-Only User roles could execute unauthorized code on endpoints running the SSH Known Hosts sensor. CVSS 7.5 (AC:H). Fixed in 4.9.480, 4.12.353, 4.17.333. No workaround. No exploitation reported.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Threat Response","fixed":["4.9.480","4.12.353","4.17.333"],"affected":">= 4.9, < 4.9.480; >= 4.12, < 4.12.353; >= 4.17, < 4.17.333","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","endpoint-security","other","self-hosted","tanium","threat-response"],"not_affected_if":["auth-required","no-threat-response"],"how_to_check":"In the Tanium console, check the installed Threat Response version: affected if 4.9 < 4.9.480, 4.12 < 4.12.353 or 4.17 < 4.17.333. Also check who holds the Threat Response User and Interact Read-Only User roles and whether the SSH Known Hosts sensor is used on endpoints.","fix":"Update Threat Response to Update 27 (4.9.480), Update 17 (4.12.353) or Update 10 (4.17.333), or later. Vendor lists no workarounds.","status":"open","published_at":"2026-11-03T23:17:30+00:00","first_seen_at":"2026-11-03T23:45:13+00:00","triaged_at":"2026-11-03T23:45:31+00:00","updated_at":"2026-11-03T23:46:40+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-03T23:45:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Tanium Threat Response: unauthorized code execution flaw, details unknown","impact":"high","summary":"Tanium fixed a flaw in its Threat Response product that allows unauthorized code execution. The sources do not describe the attack path or which versions are affected.","audience":"businesses","category":"other","nicknames":[],"who_cares":["tanium","threat-response","endpoint-security"],"confidence":0.35,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs unauthorized code on affected endpoints","analyst_note":"Find Tanium's advisory for Threat Response to get affected versions, fixed versions, and attack prerequisites (https://nvd.nist.gov/vuln/detail/CVE-2026-116651).","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000591,"input_tokens":4042,"output_tokens":374,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Tanium's advisory for Threat Response to get affected versions, fixed versions, and attack prerequisites (https://nvd.nist.gov/vuln/detail/CVE-2026-116651).","search":"'-088':51B '-116651':18A,21A '-2026':17A,20A,50B '-78':41B '4.12.353':87B '4.17.333':88B '4.9.480':86B '7.5':81B 'ac':82B 'address':95C 'authent':4A,53B 'bulletin':48B 'code':8A,71B,98C 'command':25B,38B 'command-inject':24B 'could':68B 'cve':16A,19A 'cvss':80B 'cwe':40B 'endpoint':10A,28B,73B 'endpoint-secur':27B 'execut':69B,99C 'exploit':92B 'fix':84B 'h':83B 'host':14A,33B,78B 'inject':26B,39B 'interact':62B 'known':13A,77B 'per':46B 'read':64B 'read-on':63B 'report':93B 'respons':3A,37B,45B,59B,103C 'response':23A 'role':67B 'run':7A,74B 'secur':29B 'self':32B 'self-host':31B 'sensor':15A,79B 'ssh':12A,76B 'tan':49B 'tanium':1A,34B,43B,47B,54B,94C 'threat':2A,22A,36B,44B,58B,102C 'threat-respons':35B 'unauthor':70B,97C 'user':5A,55B,60B,66B 'via':11A 'vulner':100C 'workaround':90B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Tanium deployments running Threat Response below 4.9.480, 4.12.353 or 4.17.333. An attacker needs a Tanium account with the Threat Response User and Interact Read-Only User roles, and the code runs on endpoints with the SSH Known Hosts sensor. Teams without Threat Response can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T23:46:40Z","by":"analyst","doc":"https://security.tanium.com/TAN-2026-088","run_id":1581},"workarounds":{"at":"2026-11-03T23:46:40Z","by":"analyst","doc":"https://security.tanium.com/TAN-2026-088","run_id":1581}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["response","threatresponse"],"ptokens":["response","threat"],"labels":["commandinjection","endpointsecurity","high","other","selfhosted","tanium","threatresponse"],"campaign_type":null,"first_public_at":"2026-11-03T23:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"3938794e-25f5-4123-a1ba-5cbd7f104512","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116651","severity":null,"published_at":"2026-11-03T23:17:30+00:00","modified_at":"2026-11-03T23:17:31+00:00","first_seen_at":"2026-11-03T23:45:13+00:00","fetched_at":"2026-11-03T23:45:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116651:1581","url":null,"severity":null,"published_at":"2026-11-03T23:46:40+00:00","modified_at":"2026-11-03T23:46:40+00:00","first_seen_at":"2026-11-03T23:46:40+00:00","fetched_at":"2026-11-03T23:46:40+00:00","note":"Matched to TAN-2026-088 (vendor page; it does not print the CVE id, mapping comes from the CVE record via HOL Guard; sibling TAN-2026-095 has identical vector and fix versions but a Linux quarantine package vector, likely CVE-2026-116650). Fix versions identical in both, so fix verified; who_affected and trigger not marked verified."}],"documents":[{"id":61710,"url":"https://security.tanium.com/TAN-2026-088","title":"TAN-2026-088 Tanium Threat Response","kind":"advisory","source":"analyst","publisher":null,"text":"Tanium addressed an unauthorized code execution vulnerability in Threat Response. High, 7.5, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. An authenticated Tanium user with the Threat Response User and Interact Read-Only User roles could execute unauthorized code on endpoints running the SSH Known Hosts sensor. Affected: Threat Response 4.9 to 4.9.479, 4.12 to 4.12.352, 4.17 to 4.17.332. Fixed: Update 27 (4.9.480), Update 17 (4.12.353), Update 10 (4.17.333). Workarounds: None. The page does not print the CVE id.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":61711,"url":"https://hol.org/guard/security/cves/CVE-2026-116651-tanium-addressed-an-unauthorized-code-execution","title":"HOL Guard CVE-2026-116651","kind":"other","source":"analyst","publisher":null,"text":"Feed record: CWE-78, CVSS 7.5, fixed 4.9.480, 4.12.353, 4.17.333; CVE reference cited: security.tanium.com/TAN-2026-088.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}