CVE-2026-108332: Tanium Threat Response symlink resolution privilege escalation

CVE-2026-108332 · Severity: medium · CVSS 6.3 · Published 2026-10-27

Tanium's Threat Response Client Extension, a security scanning tool deployed on corporate endpoints, contains a symlink resolution vulnerability that could allow an attacker to trick the system into authenticating to a malicious network location using the machine's credentials. An attacker with local system access could exploit this by placing a specially crafted shortcut file in a startup folder, potentially allowing credential theft and lateral movement within the network.

Technologies: Tanium Endpoint Configuration Toolset Solution. Vendors: Tanium.

Quick answers

Is CVE-2026-108332 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-108332 being exploited in the wild.
How severe is CVE-2026-108332?
Medium severity, with a CVSS score of 6.3, published 27 October 2026.
Which products and versions are affected?
Tanium Endpoint Configuration Toolset Solution 2025H1 v1.51.0–v1.51.60; 2025H2 v1.59.0–v1.59.50; 2026H1 v1.71.0–v1.71.25; Tanium Threat Response Client Extension 1.17 prior to 1.17.802, 1.18 prior to 1.18.2732, 1.19 prior to 1.19.2213, 1.20 prior to 1.20.2271, 1.21 prior to 1.21.1673.
Is there a fix for CVE-2026-108332?
Yes: fixed in Threat Response Client Extension 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271, 1.21.1673 or later; Endpoint Configuration Toolset Solution 2025H1 Update 26 (v1.51.60), 2025H2 Update 16 (v1.59.50), 2026H1 Update 9 (v1.71.25) or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108332 attacked?
It is attacked with local access.
Am I affected by CVE-2026-108332?
Check whether you run Tanium Endpoint Configuration Toolset Solution or Tanium Threat Response Client Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Threat Response Client Extension 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271, 1.21.1673 or later; Endpoint Configuration Toolset Solution 2025H1 Update 26 (v1.51.60), 2025H2 Update 16 (v1.59.50), 2026H1 Update 9 (v1.71.25) or later

Technical details

The vulnerability is an improper link resolution (CWE-59) in Threat Response Client Extension that occurs before file access. An attacker with local access and user-level privileges can place a crafted shortcut file in a user-writable startup folder; when Threat Response scans it, the client resolves the link and authenticates to an attacker-controlled network location using the machine account, allowing NTLM credential relay attacks against other network services.

Affected products

  • Tanium Threat Response Client Extension 1.17 prior to 1.17.802, 1.18 prior to 1.18.2732, 1.19 prior to 1.19.2213, 1.20 prior to 1.20.2271, 1.21 prior to 1.21.1673
  • Tanium Endpoint Configuration Toolset Solution 2025H1 v1.51.0–v1.51.60; 2025H2 v1.59.0–v1.59.50; 2026H1 v1.71.0–v1.71.25

Timeline

  • 2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.