Is CVE-2026-86865 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86865 being exploited in the wild.

How severe is CVE-2026-86865?

High severity, with a CVSS score of 7.2, published 16 September 2026.

Which products and versions are affected?

Tanium Asset 2025H1 prior to Update 25 (v1.33.326), 2025H2 prior to Update 15 (v1.36.174), 2026H1 prior to Update 8 (v1.39.153).

Is there a fix for CVE-2026-86865?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86865 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-86865?

Check whether you run Tanium Asset at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86865: Tanium Asset SQL injection

CVE-2026-86865 · Severity: high · CVSS 7.2 · Published 2026-09-16

Tanium Asset is a service that manages IT asset inventory and configuration across enterprise environments. A SQL injection vulnerability allows authenticated users with asset configuration permissions to manipulate database queries, potentially exposing sensitive asset data or modifying asset records, which could compromise IT governance and compliance reporting.

Technologies: Tanium Asset. Vendors: Tanium.

Quick answers

Is CVE-2026-86865 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86865 being exploited in the wild.
How severe is CVE-2026-86865?: High severity, with a CVSS score of 7.2, published 16 September 2026.
Which products and versions are affected?: Tanium Asset 2025H1 prior to Update 25 (v1.33.326), 2025H2 prior to Update 15 (v1.36.174), 2026H1 prior to Update 8 (v1.39.153).
Is there a fix for CVE-2026-86865?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86865 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-86865?: Check whether you run Tanium Asset at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in Tanium Asset that allows an authenticated user with Asset Configuration Write permissions to inject arbitrary SQL commands into queries executed by the Asset service. The vulnerability is network-accessible (AV:N) with high complexity requirements (authenticated, high privileges required), but once exploited grants the attacker ability to read (C:H), modify (I:H), and potentially disrupt (A:H) asset database contents. The attack requires authentication and specific IAM permissions, limiting the attack surface. Patches are available: Asset v1.33.326 or later (2025H1), v1.36.174 or later (2025H2), and v1.39.153 or later (2026H1).

Affected products

Tanium Asset 2025H1 prior to Update 25 (v1.33.326), 2025H2 prior to Update 15 (v1.36.174), 2026H1 prior to Update 8 (v1.39.153)

Timeline

2026-09-16: disclosed

References

https://security.tanium.com/TAN-2026-049

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.