# CVE-2026-6392: Tanium Threat Response information disclosure in Configs

Source: https://junglewise.ai/threats/cve-2026-6392-tanium-threat-response-information-disclosure-in-configs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-6392 · Severity: low · CVSS 2.7 · Published 2026-04-22

Tanium has addressed a security flaw in its Threat Response module, which is used by organizations to detect and respond to security incidents on endpoints. An authorized user with specific configuration-reading permissions could potentially view sensitive data they are not supposed to see. While the risk is low because it requires high-level access, it could lead to unauthorized internal information disclosure.

Technologies: [Tanium Threat Response](https://junglewise.ai/threats/technologies/threat-response). Vendors: [Tanium](https://junglewise.ai/threats/vendors/tanium).

## Quick answers

**Is CVE-2026-6392 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6392 being exploited in the wild.

**How severe is CVE-2026-6392?** Low severity, with a CVSS score of 2.7, published 22 April 2026.

**Which products and versions are affected?** Tanium Threat Response 4.6.0 to 4.6.577, 4.9.0 to 4.9.379.

**Is there a fix for CVE-2026-6392?** A patch was published on 2026-04-21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6392 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-6392?** Check whether you run Tanium Threat Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability (CWE-200) exists in Tanium Threat Response due to insufficient access controls. An authenticated attacker with 'Threat Response Configs - Read' permissions can exploit this flaw over the network to gain read-only access to sensitive data beyond their intended scope. The vulnerability requires high privileges (PR:H) and has no impact on system integrity or availability. The issue is resolved in Threat Response versions 4.6.577 (Update 23), 4.9.379 (Update 17), and 4.12.251 (Update 7).

## Affected products

- Tanium Threat Response 4.6.0 to 4.6.577, 4.9.0 to 4.9.379

## Timeline

- 2026-04-21: disclosed
- 2026-04-21: advisory
- 2026-04-21: patched

## References

- [https://security.tanium.com/TAN-2026-011](https://security.tanium.com/TAN-2026-011)

## Related threats

- [Tanium multiple products improper certificate validation](https://junglewise.ai/threats/cve-2026-121565-tanium-addressed-an-improper-certificate-validation)
- [Tanium Threat Response input validation bypass in Live Response](https://junglewise.ai/threats/cve-2026-116654-tanium-addressed-an-improper-input-validation-vulnerability-in)
- [Tanium Threat Response improper input validation](https://junglewise.ai/threats/cve-2026-116653-tanium-addressed-an-improper-input-validation-vulnerability-in)
- [Tanium Threat Response business logic error](https://junglewise.ai/threats/cve-2026-116652-tanium-addressed-a-business-logic-error-in-threat-response)
- [Tanium Threat Response unauthorized code execution in SSH Known Hosts sensor](https://junglewise.ai/threats/cve-2026-116651-tanium-addressed-an-unauthorized-code-execution-vulnerability-in)