# CVE-2026-108332: Tanium Threat Response symlink resolution privilege escalation

Source: https://junglewise.ai/threats/cve-2026-108332-tanium-addressed-an-improper-link-resolution-before-file-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-108332 · Severity: medium · CVSS 6.3 · Published 2026-10-27

Tanium's Threat Response Client Extension, a security scanning tool deployed on corporate endpoints, contains a symlink resolution vulnerability that could allow an attacker to trick the system into authenticating to a malicious network location using the machine's credentials. An attacker with local system access could exploit this by placing a specially crafted shortcut file in a startup folder, potentially allowing credential theft and lateral movement within the network.

Technologies: [Tanium Endpoint Configuration Toolset Solution](https://junglewise.ai/threats/technologies/endpoint-configuration-toolset-solution). Vendors: [Tanium](https://junglewise.ai/threats/vendors/tanium).

## Quick answers

**Is CVE-2026-108332 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108332 being exploited in the wild.

**How severe is CVE-2026-108332?** Medium severity, with a CVSS score of 6.3, published 27 October 2026.

**Which products and versions are affected?** Tanium Endpoint Configuration Toolset Solution 2025H1 v1.51.0–v1.51.60; 2025H2 v1.59.0–v1.59.50; 2026H1 v1.71.0–v1.71.25; Tanium Threat Response Client Extension 1.17 prior to 1.17.802, 1.18 prior to 1.18.2732, 1.19 prior to 1.19.2213, 1.20 prior to 1.20.2271, 1.21 prior to 1.21.1673.

**Is there a fix for CVE-2026-108332?** Yes: fixed in Threat Response Client Extension 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271, 1.21.1673 or later; Endpoint Configuration Toolset Solution 2025H1 Update 26 (v1.51.60), 2025H2 Update 16 (v1.59.50), 2026H1 Update 9 (v1.71.25) or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108332 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-108332?** Check whether you run Tanium Endpoint Configuration Toolset Solution or Tanium Threat Response Client Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Threat Response Client Extension 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271, 1.21.1673 or later; Endpoint Configuration Toolset Solution 2025H1 Update 26 (v1.51.60), 2025H2 Update 16 (v1.59.50), 2026H1 Update 9 (v1.71.25) or later

## Technical details

The vulnerability is an improper link resolution (CWE-59) in Threat Response Client Extension that occurs before file access. An attacker with local access and user-level privileges can place a crafted shortcut file in a user-writable startup folder; when Threat Response scans it, the client resolves the link and authenticates to an attacker-controlled network location using the machine account, allowing NTLM credential relay attacks against other network services.

## Affected products

- Tanium Threat Response Client Extension 1.17 prior to 1.17.802, 1.18 prior to 1.18.2732, 1.19 prior to 1.19.2213, 1.20 prior to 1.20.2271, 1.21 prior to 1.21.1673
- Tanium Endpoint Configuration Toolset Solution 2025H1 v1.51.0–v1.51.60; 2025H2 v1.59.0–v1.59.50; 2026H1 v1.71.0–v1.71.25

## Timeline

- 2026-10-27: disclosed

## References

- [https://security.tanium.com/TAN-2026-055](https://security.tanium.com/TAN-2026-055)

## Related threats

- [Tanium multiple products improper certificate validation](https://junglewise.ai/threats/cve-2026-121565-tanium-addressed-an-improper-certificate-validation)
- [Tanium Stream Client Extension improper certificate validation](https://junglewise.ai/threats/cve-2026-108326-tanium-addressed-an-improper-certificate-validation)
- [Tanium Endpoint Configuration Performance Client Extension denial of service](https://junglewise.ai/threats/cve-2026-108309-tanium-addressed-an-uncontrolled-resource-consumption)
- [Tanium Index heap buffer overflow](https://junglewise.ai/threats/cve-2026-108307-tanium-addressed-a-heap-based-buffer-overflow-vulnerability-in)
- [Tanium End-User Notifications local privilege escalation](https://junglewise.ai/threats/cve-2026-108306-tanium-addressed-a-local-privilege-escalation-vulnerability-in)