Skip to content

TAN-2026-053

Tanium addressed a SQL injection vulnerability in Patch.

Severity: Medium

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Impact

This vulnerability could allow an authenticated Tanium user with the "Patch Show" permission to gain read-only access to data they should not have access to.

Products Affected

2025H1 Release:

  • Patch prior to Update 26 (v3.24 to v3.24.306)

2025H2 Release:

  • Patch prior to Update 16 (v3.28 to v3.28.325)

2026H1 Release:

  • Patch prior to Update 9 (v3.32 to v3.32.353)

Available Updates

2025H1 Release:

  • Update 26 (Patch v3.24.306) and later

2025H2 Release:

  • Update 16 (Patch v3.28.325) and later

2026H1 Release:

  • Update 9 (Patch v3.32.353) and later

Workaround and Mitigations

None.

Acknowledgements

None.