TAN-2026-055

Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.

Severity: Medium

Base Score: 6.3

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Impact

This vulnerability could allow an attacker with access to a system running the Tanium Client to cause the endpoint to authenticate to an attacker-controlled network location with its machine account when Threat Response scans a crafted shortcut file in a user-writable startup folder. The resulting NTLM authentication could be relayed to other network services.

Products Affected

2025H1 Release:

• Endpoint Configuration Toolset Solution prior to Update 26 (v1.51.0 to v1.51.60)

2025H2 Release:

• Endpoint Configuration Toolset Solution prior to Update 16 (v1.59.0 to v1.59.50)

2026H1 Release:

• Endpoint Configuration Toolset Solution prior to Update 9 (v1.71.0 to v1.71.25)

Vulnerable tool versions:

• threat-response-cx 1.17 prior to 1.17.802
• threat-response-cx 1.18 prior to 1.18.2732
• threat-response-cx 1.19 prior to 1.19.2213
• threat-response-cx 1.20 prior to 1.20.2271
• threat-response-cx 1.21 prior to 1.21.1673

Available Updates

2025H1 Release:

• Update 26 (Endpoint Configuration Toolset Solution v1.51.60) and later

2025H2 Release:

• Update 16 (Endpoint Configuration Toolset Solution v1.59.50) and later

2026H1 Release:

• Update 9 (Endpoint Configuration Toolset Solution v1.71.25) and later

In addition to upgrading all impacted software, Tanium on-prem customers who use ECM should use Change Management in Endpoint Configuration to deploy one of the following Manifests to all endpoints:

• 2.13.327 or later
• 2.21.324 or later
• 2.35.252 or later

Tanium Cloud customers who use ECM should use Change Management in Endpoint Configuration to deploy one of the following Manifests to all endpoints:

• 2.40.225 or later
• 2.42.176 or later
• 2.44.127 or later
• 2.46.101 or later

Workaround and Mitigations

None.

Acknowledgements

None.