Information Disclosure Vulnerability in Tanium Threat Response

Mitigation Strategies

The vulnerability is addressed by applying updates to Tanium Threat Response. Specifically, update to Update 23 (v4.6.577) or later for the 2024H2 release, Update 17 (v4.9.379) or later for the 2025H1 release, or Update 7 (v4.12.251) or later for the 2025H2 release.

No workarounds or alternative mitigations are available according to the provided information.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-6392 is an information disclosure vulnerability in Tanium Threat Response.

It allows an authenticated Tanium user who has the "Threat Response Configs - Read" permission to gain unauthorized read-only access to data beyond their intended scope.

This vulnerability has a low severity with a CVSS 3.1 base score of 2.7.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of information to users who should not have access to certain data within Tanium Threat Response.

Specifically, users with the "Threat Response Configs - Read" permission might view sensitive data beyond their authorized scope, potentially exposing confidential or sensitive information.

There are no known workarounds or mitigations available for this vulnerability other than applying the updates provided by Tanium.

Useful 0 Not Useful 0

Detection Guidance

CVE-2026-6392 is an information disclosure vulnerability that requires an authenticated Tanium user with specific permissions to exploit. Detection would involve verifying user permissions and monitoring for unauthorized access attempts.

No specific detection commands or network/system scanning methods are provided in the available resources.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated Tanium user with specific read permissions to access data beyond their intended scope, which could potentially lead to unauthorized information disclosure.

Such unauthorized data access may impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to sensitive information to protect privacy and confidentiality.

However, the provided information does not explicitly state the direct effects on compliance with these standards.

Useful 0 Not Useful 0