Skip to content

TAN-2026-056

Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.

Severity: Low

Base Score: 3.6

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L

Impact

This vulnerability could allow an attacker with access to a system running the Tanium Client to cause Threat Response to crash on that particular endpoint, or to include portions of Threat Response process memory in the file properties that are reported to the Tanium Server.

Products Affected

2025H1 Release:

  • Endpoint Configuration Toolset Solution prior to Update 26 (v1.51.0 to v1.51.60)

2025H2 Release:

  • Endpoint Configuration Toolset Solution prior to Update 16 (v1.59.0 to v1.59.50)

2026H1 Release:

  • Endpoint Configuration Toolset Solution prior to Update 9 (v1.71.0 to v1.71.25)

Vulnerable tool versions:

  • threat-response-cx 1.17 prior to 1.17.802
  • threat-response-cx 1.18 prior to 1.18.2732
  • threat-response-cx 1.19 prior to 1.19.2213
  • threat-response-cx 1.20 prior to 1.20.2271
  • threat-response-cx 1.21 prior to 1.21.1673

Available Updates

2025H1 Release:

  • Update 26 (Endpoint Configuration Toolset Solution v1.51.60) and later

2025H2 Release:

  • Update 16 (Endpoint Configuration Toolset Solution v1.59.50) and later

2026H1 Release:

  • Update 9 (Endpoint Configuration Toolset Solution v1.71.25) and later

In addition to upgrading all impacted software, Tanium on-prem customers who use ECM should use Change Management in Endpoint Configuration to deploy one of the following Manifests to all endpoints:

  • 2.13.327 or later
  • 2.21.324 or later
  • 2.35.252 or later

Tanium Cloud customers who use ECM should use Change Management in Endpoint Configuration to deploy one of the following Manifests to all endpoints:

  • 2.40.225 or later
  • 2.42.176 or later
  • 2.44.127 or later
  • 2.46.101 or later

Workaround and Mitigations

None.

Acknowledgements

None.