# CVE-2026-116654: Tanium Threat Response input validation bypass in Live Response

Source: https://junglewise.ai/threats/cve-2026-116654-tanium-addressed-an-improper-input-validation-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-116654 · Severity: medium · CVSS 6.5 · Published 2026-11-03

Tanium Threat Response is a security platform that collects and analyzes threat data from endpoints across an organization. An authenticated user with specific permissions can exploit an input validation flaw to redirect collected threat data to destinations outside the organization, potentially exposing sensitive security intelligence to attackers.

Technologies: [Tanium Threat Response](https://junglewise.ai/threats/technologies/threat-response). Vendors: [Tanium](https://junglewise.ai/threats/vendors/tanium).

## Quick answers

**Is CVE-2026-116654 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116654 being exploited in the wild.

**How severe is CVE-2026-116654?** Medium severity, with a CVSS score of 6.5, published 3 November 2026.

**Which products and versions are affected?** Tanium Threat Response 2025H1 (v4.9 to v4.9.480); 2025H2 (v4.12 to v4.12.353); 2026H1 (v4.17 to v4.17.333).

**Is there a fix for CVE-2026-116654?** Yes: fixed in Threat Response 2025H1 Update 27 (v4.9.480), 2025H2 Update 17 (v4.12.353), 2026H1 Update 10 (v4.17.333) and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116654 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-116654?** Check whether you run Tanium Threat Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Threat Response 2025H1 Update 27 (v4.9.480), 2025H2 Update 17 (v4.12.353), 2026H1 Update 10 (v4.17.333) and later

## Technical details

The vulnerability is an improper input validation flaw in Tanium Threat Response's Live Response Destinations feature. An authenticated attacker with Threat Response Live Response Destinations write permission can bypass validation to redirect collected data to unauthorized external destinations. The attack requires valid credentials and the specific write permission but succeeds over the network without user interaction.

## Affected products

- Tanium Threat Response 2025H1 (v4.9 to v4.9.480); 2025H2 (v4.12 to v4.12.353); 2026H1 (v4.17 to v4.17.333)

## Timeline

- 2026-11-03: advisory

## References

- [https://security.tanium.com/TAN-2026-083](https://security.tanium.com/TAN-2026-083)

## Related threats

- [Tanium multiple products improper certificate validation](https://junglewise.ai/threats/cve-2026-121565-tanium-addressed-an-improper-certificate-validation)
- [Tanium Threat Response improper input validation](https://junglewise.ai/threats/cve-2026-116653-tanium-addressed-an-improper-input-validation-vulnerability-in)
- [Tanium Threat Response business logic error](https://junglewise.ai/threats/cve-2026-116652-tanium-addressed-a-business-logic-error-in-threat-response)
- [Tanium Threat Response unauthorized code execution in SSH Known Hosts sensor](https://junglewise.ai/threats/cve-2026-116651-tanium-addressed-an-unauthorized-code-execution-vulnerability-in)
- [Tanium Threat Response unauthorized code execution](https://junglewise.ai/threats/cve-2026-116650-tanium-addressed-an-unauthorized-code-execution-vulnerability-in)