7.8
HighCVSS 3.1 · from Tanium
CVE-2026-108306
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Endpoint Configuration Toolset Solution · Link following · CWE-59AffectedEndpoint Configuration Toolset Solution, end-user-cx
FixUpdate to 1.51.60, 1.59.50, 1.71.25, 1.8.47 or newer
PublishedOct 27, 17:35 · Tanium
ScoredOct 27 · 7.8 · Tanium
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:04 UTC
What we know
No known exploitation. CISA KEV, checked 22:04 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
From Tanium
Affected and fixed versions
ProductAffectedFixed inEndpoint Configuration Toolset Solution1.51 – before 1.51.601.51.60Endpoint Configuration Toolset Solution1.59 – before 1.59.501.59.50Endpoint Configuration Toolset Solution1.71 – before 1.71.251.71.25end-user-cx1.8.47 – before 1.8.471.8.47end-user-cx1.11.605 – before 1.11.6051.11.605end-user-cx1.19.325 – before 1.19.3251.19.325end-user-cx1.21.835 – before 1.21.8351.21.835end-user-cx1.22.1199 – before 1.22.11991.22.1199end-user-cx1.23.766 – before 1.23.7661.23.766end-user-cx1.24.590 – before 1.24.5901.24.590
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known