TAN-2026-058

Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

Severity: High

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact

This vulnerability could allow an attacker with access to a system running the Tanium Client to achieve local privilege escalation when a privileged file operation follows a link in a user-controlled location.

Products Affected

2025H1 Release:

Endpoint Configuration Toolset Solution prior to Update 26 (v1.51 to v1.51.60)

2025H2 Release:

Endpoint Configuration Toolset Solution prior to Update 16 (v1.59 to v1.59.50)

2026H1 Release:

Endpoint Configuration Toolset Solution prior to Update 9 (v1.71 to v1.71.25)

Vulnerable tool versions:

end-user-cx 1.8 prior to 1.8.47
end-user-cx 1.11 prior to 1.11.605
end-user-cx 1.19 prior to 1.19.325
end-user-cx 1.21 prior to 1.21.835
end-user-cx 1.22 prior to 1.22.1199
end-user-cx 1.23 prior to 1.23.766
end-user-cx 1.24 prior to 1.24.590

Available Updates

2025H1 Release:

Update 26 (Endpoint Configuration Toolset Solution v1.51.60) and later

2025H2 Release:

Update 16 (Endpoint Configuration Toolset Solution v1.59.50) and later

2026H1 Release:

Update 9 (Endpoint Configuration Toolset Solution v1.71.25) and later

In addition to upgrading all impacted software, Tanium on-prem customers who use ECM should use Change Management in Endpoint Configuration to deploy one of the following Manifests to all endpoints:

2.13.327 or later
2.21.324 or later
2.35.252 or later

Tanium Cloud customers who use ECM should use Change Management in Endpoint Configuration to deploy one of the following Manifests to all endpoints:

2.40.197 or later
2.42.152 or later
2.44.102 or later
2.46.75 or later

Workaround and Mitigations

None.

Acknowledgements

None.