CVE-2026-108304: Tanium End-User Notifications local privilege escalation

CVE-2026-108304 · Severity: high · CVSS 7.8 · Published 2026-10-27

Tanium End-User Notifications, a component of endpoint configuration management, contains a local privilege escalation vulnerability that allows attackers with system access to gain elevated privileges through symlink manipulation. This could allow an attacker to take complete control of an endpoint and access sensitive data or deploy malware.

Technologies: Tanium Endpoint Configuration Toolset Solution. Vendors: Tanium.

Quick answers

Is CVE-2026-108304 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-108304 being exploited in the wild.
How severe is CVE-2026-108304?
High severity, with a CVSS score of 7.8, published 27 October 2026.
Which products and versions are affected?
Tanium End-User-Cx 1.8 prior to 1.8.47, 1.11 prior to 1.11.605, 1.19 prior to 1.19.325, 1.21 prior to 1.21.835, 1.22 prior to 1.22.1199, 1.23 prior to 1.23.766, 1.24 prior to 1.24.590; Tanium Endpoint Configuration Toolset Solution 2025H1 v1.51 to v1.51.59; 2025H2 v1.59 to v1.59.49; 2026H1 v1.71 to v1.71.24.
Is there a fix for CVE-2026-108304?
Yes: fixed in Endpoint Configuration Toolset Solution 2025H1 Update 26 (v1.51.60) and later; 2025H2 Update 16 (v1.59.50) and later; 2026H1 Update 9 (v1.71.25) and later. end-user-cx 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766, 1.24.590 and later. Until then: In addition to upgrading, Tanium on-prem customers using ECM should deploy Manifests 2.13.327, 2.21.324, or 2.35.252 or later to all endpoints. Tanium Cloud customers should deploy Manifests 2.40.197, 2.42.152, 2.44.102, or 2.46.75 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108304 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-108304?
Check whether you run Tanium End-User-Cx or Tanium Endpoint Configuration Toolset Solution at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Endpoint Configuration Toolset Solution 2025H1 Update 26 (v1.51.60) and later; 2025H2 Update 16 (v1.59.50) and later; 2026H1 Update 9 (v1.71.25) and later. end-user-cx 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766, 1.24.590 and later

In addition to upgrading, Tanium on-prem customers using ECM should deploy Manifests 2.13.327, 2.21.324, or 2.35.252 or later to all endpoints. Tanium Cloud customers should deploy Manifests 2.40.197, 2.42.152, 2.44.102, or 2.46.75 or later.

Technical details

A local privilege escalation vulnerability exists in Tanium End-User Notifications where a privileged file operation follows a symlink in a user-controlled location. An attacker with local access to a system running the Tanium Client can exploit this to escalate privileges. The vulnerability requires local access but no user interaction or additional privileges beyond basic user-level access.

Affected products

  • Tanium Endpoint Configuration Toolset Solution 2025H1 v1.51 to v1.51.59; 2025H2 v1.59 to v1.59.49; 2026H1 v1.71 to v1.71.24
  • Tanium end-user-cx 1.8 prior to 1.8.47, 1.11 prior to 1.11.605, 1.19 prior to 1.19.325, 1.21 prior to 1.21.835, 1.22 prior to 1.22.1199, 1.23 prior to 1.23.766, 1.24 prior to 1.24.590

Timeline

  • 2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.