Advisory · CVE-2026-108329
Tanium Threat Response code execution flaw fixed across three release branches
Tanium Threat Response contains an unauthorized code execution vulnerability that a low-privileged network attacker can exploit, addressed by Tanium in advisory TAN-2026-064 with fixed builds for the 4.9, 4.12, and 4.17 branches. CVSS 3.1 8.8.
- Vendor
- Tanium
- Product
- Threat Response
- Identifier / CWE
- CVE-2026-108329
CWE-77 - Action timing
- Immediate
Explain it like I’m five
The incident response console itself can be made to run an attacker's commands. The tool responders use to investigate a compromise becomes the way in.
- 01Attacker reaches the service
A network attacker with low privileges reaches the affected Threat Response component.
- 02Crafted input delivered
The attacker submits input that the component fails to neutralize before use in a command context (CWE-77).
- 03Code executes
Per Tanium's record, the result is unauthorized code execution on the affected system.
What happened
Tanium published CVE-2026-108329 on October 27, 2026 in advisory TAN-2026-064, rated high at CVSS 3.1 8.8: Tanium addressed an unauthorized code execution vulnerability in Threat Response. The vector in the record is network-reachable with low privileges and no user interaction. Tanium’s public description is brief and does not detail the affected component beyond Threat Response, so this advisory does not speculate further.
The record lists Threat Response 4.9 before 4.9.476, 4.12 before 4.12.349, and 4.17 before 4.17.327 as affected, making those boundary builds the fixed versions for each branch.
What to do
- Inventory Tanium Threat Response deployments and note the version and branch of each.
- Upgrade to 4.9.476, 4.12.349, or 4.17.327 or later, matching the branch in use, per advisory TAN-2026-064.
- Until upgraded, restrict network access to Threat Response components to authorized responder workstations and jump hosts.
- Review Threat Response and host logs for unexpected command execution, new scheduled tasks or services, and responder actions nobody recognizes.
- Verify the deployed build after updating.
Management note
Endpoint platforms run with extraordinary privilege by design, which makes their own vulnerabilities top-tier. Keep Tanium components on the fastest patch ring you have and log their administrative actions as carefully as you log a domain controller’s.