Is CVE-2026-116653 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116653 being exploited in the wild.

How severe is CVE-2026-116653?

Medium severity, with a CVSS score of 4.3, published 3 November 2026.

Which products and versions are affected?

Tanium Threat Response 2025H1 Release v4.9 to v4.9.480; 2025H2 Release v4.12 to v4.12.353; 2026H1 Release v4.17 to v4.17.333.

Is there a fix for CVE-2026-116653?

Yes: fixed in Threat Response 2025H1 Release Update 27 (v4.9.480) and later; 2025H2 Release Update 17 (v4.12.353) and later; 2026H1 Release Update 10 (v4.17.333) and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116653 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-116653?

Check whether you run Tanium Threat Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116653: Tanium Threat Response improper input validation

CVE-2026-116653 · Severity: medium · CVSS 4.3 · Published 2026-11-03

Tanium Threat Response is an endpoint protection and threat detection tool used across enterprise networks. An improper input validation vulnerability allows authenticated users with write permissions to interfere with threat detection and response functionality on endpoints, potentially disabling or degrading security controls.

Technologies: Tanium Threat Response. Vendors: Tanium.

Quick answers

Is CVE-2026-116653 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116653 being exploited in the wild.
How severe is CVE-2026-116653?: Medium severity, with a CVSS score of 4.3, published 3 November 2026.
Which products and versions are affected?: Tanium Threat Response 2025H1 Release v4.9 to v4.9.480; 2025H2 Release v4.12 to v4.12.353; 2026H1 Release v4.17 to v4.17.333.
Is there a fix for CVE-2026-116653?: Yes: fixed in Threat Response 2025H1 Release Update 27 (v4.9.480) and later; 2025H2 Release Update 17 (v4.12.353) and later; 2026H1 Release Update 10 (v4.17.333) and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116653 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-116653?: Check whether you run Tanium Threat Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Threat Response 2025H1 Release Update 27 (v4.9.480) and later; 2025H2 Release Update 17 (v4.12.353) and later; 2026H1 Release Update 10 (v4.17.333) and later

Technical details

The vulnerability is an improper input validation flaw in Threat Response that requires authentication and the Threat Response write permission to exploit. An authenticated attacker can supply malicious input to interfere with the product's endpoint functionality. The attack vector is network-based with low complexity and no user interaction required.

Affected products

Tanium Threat Response 2025H1 Release v4.9 to v4.9.480; 2025H2 Release v4.12 to v4.12.353; 2026H1 Release v4.17 to v4.17.333

Timeline

2026-11-03: disclosed

References

https://security.tanium.com/TAN-2026-090

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.