CVE-2026-9208: Tanium addressed an unauthorized code execution vulnerability in Connect.

Synopsis

An unauthorized code execution vulnerability affects Tanium Connect, a data integration component of the Tanium endpoint management platform. The flaw is reachable over the network and requires only a low-privilege authenticated account, with no victim interaction needed. Successful exploitation gives an attacker full read, write, and availability impact on the affected service, effectively enabling remote code execution. Patched-image rebuilds at versions 5.26.191, 5.29.237, and 5.37.140 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Tanium Connect service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationRequired

  The attacker must hold a valid low-privilege account on the Tanium platform; any ordinary user credential is sufficient, per the PR:L token.

• Victim interactionNot required

  No user action, click, or social-engineering step is needed; the exploit is fully attacker-driven, per the UI:N token.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker executes arbitrary code in the context of the Tanium Connect service process.
• All data accessible to that process, including stored connection configurations and credentials, becomes readable.
• The attacker can write or modify integration data and persisted configuration, tampering with downstream data flows.
• The attacker can crash or disrupt the Connect service, blocking endpoint data collection and integration pipelines that depend on it.