Skip to content

TAN-2026-023

Tanium addressed a SQL injection vulnerability in Provision.

Severity: Medium

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Impact

This vulnerability could allow an authenticated Tanium user with the Provision Retirement Actions Read permission to tamper with the SQL query executed by the Provision service.

Products Affected

2025H1 Release:

  • Provision prior to Update 26 (v1.17 to v1.17.150)

2025H2 Release:

  • Provision prior to Update 16 (v1.23 to v1.23.161)

2026H1 Release:

  • Provision prior to Update 9 (v1.24 to v1.24.199)

Available Updates

2025H1 Release:

  • Update 26 (Provision v1.17.150) and later

2025H2 Release:

  • Update 16 (Provision v1.23.161) and later

2026H1 Release:

  • Update 9 (Provision v1.24.199) and later

Workaround and Mitigations

None.

Acknowledgements

None.