---
id: "CVE-2026-116651"
kind: "vulnerability"
aliases: ["CVE-2026-116651"]
title: "Tanium Threat Response: authenticated user can run code on endpoints via SSH Known Hosts sensor"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Threat Response", "fixed": ["4.9.480", "4.12.353", "4.17.333"], "affected": ">= 4.9, < 4.9.480; >= 4.12, < 4.12.353; >= 4.17, < 4.17.333", "ecosystem": "vendor"}]
ecosystems: []
tags: ["command-injection", "endpoint-security", "other", "self-hosted", "tanium", "threat-response"]
not_affected_if: ["auth-required", "no-threat-response"]
published_at: "2026-11-03T23:17:30+00:00"
first_seen_at: "2026-11-03T23:45:13+00:00"
updated_at: "2026-11-03T23:46:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116651", "first_seen_at": "2026-11-03T23:45:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T23:46:40+00:00"}]
---

# Tanium Threat Response: authenticated user can run code on endpoints via SSH Known Hosts sensor

Command injection (CWE-78) in Tanium Threat Response. Per Tanium bulletin TAN-2026-088, an authenticated Tanium user with the Threat Response User and Interact Read-Only User roles could execute unauthorized code on endpoints running the SSH Known Hosts sensor. CVSS 7.5 (AC:H). Fixed in 4.9.480, 4.12.353, 4.17.333. No workaround. No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Threat Response affected >= 4.9, < 4.9.480; >= 4.12, < 4.12.353; >= 4.17, < 4.17.333 fixed 4.9.480, 4.12.353, 4.17.333

## How to check

In the Tanium console, check the installed Threat Response version: affected if 4.9 < 4.9.480, 4.12 < 4.12.353 or 4.17 < 4.17.333. Also check who holds the Threat Response User and Interact Read-Only User roles and whether the SSH Known Hosts sensor is used on endpoints.

## Fix

Update Threat Response to Update 27 (4.9.480), Update 17 (4.12.353) or Update 10 (4.17.333), or later. Vendor lists no workarounds.

## Timeline

- 2026-11-03T23:45:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116651
- 2026-11-03T23:46:40+00:00 analyst — Matched to TAN-2026-088 (vendor page; it does not print the CVE id, mapping comes from the CVE record via HOL Guard; sibling TAN-2026-095 has identical vector and fix versions but a Linux quarantine package vector, likely CVE-2026-116650). Fix versions identical in both, so fix verified; who_affected and trigger not marked verified.

## Documents

- [advisory] TAN-2026-088 Tanium Threat Response https://security.tanium.com/TAN-2026-088
- [mentions] HOL Guard CVE-2026-116651 https://hol.org/guard/security/cves/CVE-2026-116651-tanium-addressed-an-unauthorized-code-execution

## From the sources

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_