Is CVE-2026-108329 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108329 being exploited in the wild.

How severe is CVE-2026-108329?

High severity, with a CVSS score of 8.8, published 27 October 2026.

Which products and versions are affected?

Tanium Threat Response 2025H1 v4.9 to v4.9.475; 2025H2 v4.12 to v4.12.348; 2026H1 v4.17 to v4.17.326.

Is there a fix for CVE-2026-108329?

Yes: fixed in Threat Response 2025H1 Update 26 (v4.9.476) and later; 2025H2 Update 16 (v4.12.349) and later; 2026H1 Update 9 (v4.17.327) and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108329 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-108329?

Check whether you run Tanium Threat Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108329: Tanium Threat Response unauthorized code execution

CVE-2026-108329 · Severity: high · CVSS 8.8 · Published 2026-10-27

Tanium Threat Response is an endpoint detection and response platform used by organizations to identify and respond to security threats. A vulnerability allows authenticated users with Read Sensor permission to execute arbitrary code on endpoints running the Mac Downloaded Files sensor, potentially giving attackers control over affected systems.

Technologies: Tanium Threat Response. Vendors: Tanium.

Quick answers

Is CVE-2026-108329 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108329 being exploited in the wild.
How severe is CVE-2026-108329?: High severity, with a CVSS score of 8.8, published 27 October 2026.
Which products and versions are affected?: Tanium Threat Response 2025H1 v4.9 to v4.9.475; 2025H2 v4.12 to v4.12.348; 2026H1 v4.17 to v4.17.326.
Is there a fix for CVE-2026-108329?: Yes: fixed in Threat Response 2025H1 Update 26 (v4.9.476) and later; 2025H2 Update 16 (v4.12.349) and later; 2026H1 Update 9 (v4.17.327) and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108329 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-108329?: Check whether you run Tanium Threat Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Threat Response 2025H1 Update 26 (v4.9.476) and later; 2025H2 Update 16 (v4.12.349) and later; 2026H1 Update 9 (v4.17.327) and later

Technical details

An authenticated code execution vulnerability in Tanium Threat Response allows users with the Read Sensor permission to execute unauthorized code on Mac endpoints running the Downloaded Files sensor. The vulnerability requires network access and valid authentication but no additional user interaction. An attacker with valid credentials and the specified permission can gain code execution on affected endpoints.

Affected products

Tanium Threat Response 2025H1 v4.9 to v4.9.475; 2025H2 v4.12 to v4.12.348; 2026H1 v4.17 to v4.17.326

Timeline

2026-10-27: disclosed

References

https://security.tanium.com/TAN-2026-064

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.