Is CVE-2026-6392 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6392 being exploited in the wild.

How severe is CVE-2026-6392?

Low severity, with a CVSS score of 2.7, published 22 April 2026.

Which products and versions are affected?

Tanium Threat Response 4.6.0 to 4.6.577, 4.9.0 to 4.9.379.

Is there a fix for CVE-2026-6392?

A patch was published on 2026-04-21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6392 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-6392?

Check whether you run Tanium Threat Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6392: Tanium Threat Response information disclosure in Configs

CVE-2026-6392 · Severity: low · CVSS 2.7 · Published 2026-04-22

Tanium has addressed a security flaw in its Threat Response module, which is used by organizations to detect and respond to security incidents on endpoints. An authorized user with specific configuration-reading permissions could potentially view sensitive data they are not supposed to see. While the risk is low because it requires high-level access, it could lead to unauthorized internal information disclosure.

Technologies: Tanium Threat Response. Vendors: Tanium.

Quick answers

Is CVE-2026-6392 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6392 being exploited in the wild.
How severe is CVE-2026-6392?: Low severity, with a CVSS score of 2.7, published 22 April 2026.
Which products and versions are affected?: Tanium Threat Response 4.6.0 to 4.6.577, 4.9.0 to 4.9.379.
Is there a fix for CVE-2026-6392?: A patch was published on 2026-04-21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6392 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-6392?: Check whether you run Tanium Threat Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability (CWE-200) exists in Tanium Threat Response due to insufficient access controls. An authenticated attacker with 'Threat Response Configs - Read' permissions can exploit this flaw over the network to gain read-only access to sensitive data beyond their intended scope. The vulnerability requires high privileges (PR:H) and has no impact on system integrity or availability. The issue is resolved in Threat Response versions 4.6.577 (Update 23), 4.9.379 (Update 17), and 4.12.251 (Update 7).

Affected products

Tanium Threat Response 4.6.0 to 4.6.577, 4.9.0 to 4.9.379

Timeline

2026-04-21: disclosed
2026-04-21: advisory
2026-04-21: patched

References

https://security.tanium.com/TAN-2026-011

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.