Skip to content

TAN-2026-084

Tanium addressed an improper output sanitization vulnerability in Discover.

Severity: Medium

Base Score: 4.1

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L

Impact

This vulnerability could allow an authenticated Tanium user with the Discover Locations write permission to inject arbitrary data, including formulas, in CSV files exported by Discover. In order to exploit this vulnerability users must open the CSV file in a software that automatically executes formulas.

Products Affected

2025H1 Release:

  • Discover prior to Update 26 (v4.10.0 to v4.10.204)

2025H2 Release:

  • Discover prior to Update 16 (v4.15.0 to v4.15.218)

2026H1 Release:

  • Discover prior to Update 9 (v4.19.0 to v4.19.137)

Available Updates

2025H1 Release:

  • Update 26 (Discover v4.10.204) and later

2025H2 Release:

  • Update 16 (Discover v4.15.218) and later

2026H1 Release:

  • Update 9 (Discover v4.19.137) and later

Workaround and Mitigations

None.

Acknowledgements

None.