Is CVE-2026-116652 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116652 being exploited in the wild.

How severe is CVE-2026-116652?

Medium severity, with a CVSS score of 4.3, published 3 November 2026.

Which products and versions are affected?

Tanium Threat Response 2025H1 v4.9-v4.9.480, 2025H2 v4.12-v4.12.353, 2026H1 v4.17-v4.17.333.

Is there a fix for CVE-2026-116652?

Yes: fixed in Threat Response 2025H1 Update 27 (v4.9.480), 2025H2 Update 17 (v4.12.353), 2026H1 Update 10 (v4.17.333). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116652 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116652?

Check whether you run Tanium Threat Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116652: Tanium Threat Response business logic error

CVE-2026-116652 · Severity: medium · CVSS 4.3 · Published 2026-11-03

Tanium Threat Response is an endpoint security tool used to detect and respond to threats across networks. A business logic error allows authenticated users with specific permissions to disrupt the tool's functionality on protected systems, reducing the effectiveness of threat detection and response operations.

Technologies: Tanium Threat Response. Vendors: Tanium.

Quick answers

Is CVE-2026-116652 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116652 being exploited in the wild.
How severe is CVE-2026-116652?: Medium severity, with a CVSS score of 4.3, published 3 November 2026.
Which products and versions are affected?: Tanium Threat Response 2025H1 v4.9-v4.9.480, 2025H2 v4.12-v4.12.353, 2026H1 v4.17-v4.17.333.
Is there a fix for CVE-2026-116652?: Yes: fixed in Threat Response 2025H1 Update 27 (v4.9.480), 2025H2 Update 17 (v4.12.353), 2026H1 Update 10 (v4.17.333). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116652 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116652?: Check whether you run Tanium Threat Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Threat Response 2025H1 Update 27 (v4.9.480), 2025H2 Update 17 (v4.12.353), 2026H1 Update 10 (v4.17.333)

Technical details

A business logic error in Tanium Threat Response allows authenticated users holding the Threat Response Write permission to interfere with the product's endpoint functionality. The vulnerability requires network access and valid authentication credentials with administrative permissions; no user interaction is needed. An attacker with these permissions can cause integrity impact to the threat response system.

Affected products

Tanium Threat Response 2025H1 v4.9-v4.9.480, 2025H2 v4.12-v4.12.353, 2026H1 v4.17-v4.17.333

Timeline

2026-11-03: advisory

References

https://security.tanium.com/TAN-2026-081

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.