CVE-2026-14505
Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in Tanium Data Service

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: Tanium

Description
Tanium addressed a path traversal vulnerability in Tanium Data Service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-09
Last Modified
2026-09-09
Generated
2026-09-29
AI Q&A
2026-09-09
EPSS Evaluated
2026-09-27
NVD
CVE-2026-14505
EUVD
EUVD-2026-74546

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tanium tanium_data_service to 4.2.345 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-14505 is a path traversal vulnerability in Tanium Data Service. It allows an authenticated user with specific permissions to write arbitrary files on the Tanium Module Server by exploiting improper path validation.

Detection Guidance

To detect this vulnerability, check the version of Tanium Data Service installed on your system. Compare it against v4.2.345 or later. Commands may include verifying the installed version via package managers or Tanium's interface.

Impact Analysis

This vulnerability could allow an attacker with the right permissions to write malicious files on the server, potentially leading to unauthorized code execution, data theft, or system compromise.

Compliance Impact

The vulnerability could allow unauthorized file writes on the Tanium Module Server, potentially leading to data exfiltration or manipulation. This may impact compliance with GDPR (data integrity and confidentiality) and HIPAA (protected health information integrity) if sensitive data is compromised.

Mitigation Strategies

Immediately update Tanium Data Service to version v4.2.345 or later. Ensure no users have the 'Data Collection Pipeline Write Override' permission until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14505. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart