# CVE-2026-108329: Tanium Threat Response unauthorized code execution

Source: https://junglewise.ai/threats/cve-2026-108329-tanium-addressed-an-unauthorized-code-execution-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-108329 · Severity: high · CVSS 8.8 · Published 2026-10-27

Tanium Threat Response is an endpoint detection and response platform used by organizations to identify and respond to security threats. A vulnerability allows authenticated users with Read Sensor permission to execute arbitrary code on endpoints running the Mac Downloaded Files sensor, potentially giving attackers control over affected systems.

Technologies: [Tanium Threat Response](https://junglewise.ai/threats/technologies/threat-response). Vendors: [Tanium](https://junglewise.ai/threats/vendors/tanium).

## Quick answers

**Is CVE-2026-108329 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108329 being exploited in the wild.

**How severe is CVE-2026-108329?** High severity, with a CVSS score of 8.8, published 27 October 2026.

**Which products and versions are affected?** Tanium Threat Response 2025H1 v4.9 to v4.9.475; 2025H2 v4.12 to v4.12.348; 2026H1 v4.17 to v4.17.326.

**Is there a fix for CVE-2026-108329?** Yes: fixed in Threat Response 2025H1 Update 26 (v4.9.476) and later; 2025H2 Update 16 (v4.12.349) and later; 2026H1 Update 9 (v4.17.327) and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108329 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-108329?** Check whether you run Tanium Threat Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Threat Response 2025H1 Update 26 (v4.9.476) and later; 2025H2 Update 16 (v4.12.349) and later; 2026H1 Update 9 (v4.17.327) and later

## Technical details

An authenticated code execution vulnerability in Tanium Threat Response allows users with the Read Sensor permission to execute unauthorized code on Mac endpoints running the Downloaded Files sensor. The vulnerability requires network access and valid authentication but no additional user interaction. An attacker with valid credentials and the specified permission can gain code execution on affected endpoints.

## Affected products

- Tanium Threat Response 2025H1 v4.9 to v4.9.475; 2025H2 v4.12 to v4.12.348; 2026H1 v4.17 to v4.17.326

## Timeline

- 2026-10-27: disclosed

## References

- [https://security.tanium.com/TAN-2026-064](https://security.tanium.com/TAN-2026-064)

## Related threats

- [Tanium multiple products improper certificate validation](https://junglewise.ai/threats/cve-2026-121565-tanium-addressed-an-improper-certificate-validation)
- [Tanium Threat Response input validation bypass in Live Response](https://junglewise.ai/threats/cve-2026-116654-tanium-addressed-an-improper-input-validation-vulnerability-in)
- [Tanium Threat Response improper input validation](https://junglewise.ai/threats/cve-2026-116653-tanium-addressed-an-improper-input-validation-vulnerability-in)
- [Tanium Threat Response business logic error](https://junglewise.ai/threats/cve-2026-116652-tanium-addressed-a-business-logic-error-in-threat-response)
- [Tanium Threat Response unauthorized code execution in SSH Known Hosts sensor](https://junglewise.ai/threats/cve-2026-116651-tanium-addressed-an-unauthorized-code-execution-vulnerability-in)