CVE-2026-1224

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1224", "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512", "state": "PUBLISHED", "assignerShortName": "Tanium", "dateReserved": "2026-01-20T06:50:47.201Z", "datePublished": "2026-01-26T17:36:33.504Z", "dateUpdated": "2026-02-02T20:01:38.031Z"}, "containers": {"cna": {"affected": [{"product": "Discover", "vendor": "Tanium", "versions": [{"version": "4.10", "status": "affected", "lessThan": "4.10.134", "versionType": "custom"}, {"version": "4.15", "status": "affected", "lessThan": "4.15.130", "versionType": "custom"}], "cpes": ["cpe:2.3:a:tanium:service_asset:4.10.133:*:*:*:*:*:*:*", "cpe:2.3:a:tanium:service_asset:4.15.129:*:*:*:*:*:*:*"]}], "dateAssigned": "2026-01-20T06:50:46.661Z", "datePublic": "2026-01-24T01:37:37.554Z", "descriptions": [{"lang": "en", "value": "Tanium addressed an uncontrolled resource consumption vulnerability in Discover."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512", "shortName": "Tanium", "dateUpdated": "2026-02-02T20:01:38.031Z"}, "references": [{"name": "TAN-2026-001", "url": "https://security.tanium.com/TAN-2026-001"}], "title": "Tanium addressed an uncontrolled resource consumption vulnerability in Discover."}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T21:04:57.237600Z", "id": "CVE-2026-1224", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T21:05:07.722Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1224", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T21:04:57.237600Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T21:05:02.891Z"}}], "cna": {"title": "Tanium addressed an uncontrolled resource consumption vulnerability in Discover.", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"cpes": ["cpe:2.3:a:tanium:service_asset:4.10.133:*:*:*:*:*:*:*", "cpe:2.3:a:tanium:service_asset:4.15.129:*:*:*:*:*:*:*"], "vendor": "Tanium", "product": "Discover", "versions": [{"status": "affected", "version": "4.10", "lessThan": "4.10.134", "versionType": "custom"}, {"status": "affected", "version": "4.15", "lessThan": "4.15.130", "versionType": "custom"}]}], "datePublic": "2026-01-24T01:37:37.554Z", "references": [{"url": "https://security.tanium.com/TAN-2026-001", "name": "TAN-2026-001"}], "dateAssigned": "2026-01-20T06:50:46.661Z", "descriptions": [{"lang": "en", "value": "Tanium addressed an uncontrolled resource consumption vulnerability in Discover."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512", "shortName": "Tanium", "dateUpdated": "2026-02-02T20:01:38.031Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1224", "state": "PUBLISHED", "dateUpdated": "2026-02-02T20:01:38.031Z", "dateReserved": "2026-01-20T06:50:47.201Z", "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512", "datePublished": "2026-01-26T17:36:33.504Z", "assignerShortName": "Tanium"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:tanium:service_asset:4.10.133:*:*:*:*:*:*:*", "cpe:2.3:a:tanium:service_asset:4.15.129:*:*:*:*:*:*:*"], "product": "Discover", "vendor": "Tanium", "versions": [{"lessThan": "4.10.134", "status": "affected", "version": "4.10", "versionType": "custom"}, {"lessThan": "4.15.130", "status": "affected", "version": "4.15", "versionType": "custom"}]}], "source": "3938794e-25f5-4123-a1ba-5cbd7f104512"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tanium:discover:*:*:*:*:*:*:*:*", "matchCriteriaId": "C18F0671-1A84-47C0-93D9-23782B90148F", "versionEndExcluding": "4.10.134", "versionStartIncluding": "4.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tanium:discover:*:*:*:*:*:*:*:*", "matchCriteriaId": "B88BAB1D-6C10-4EBA-885D-94BA6F162BC9", "versionEndExcluding": "4.15.130", "versionStartIncluding": "4.15", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tanium addressed an uncontrolled resource consumption vulnerability in Discover."}, {"lang": "es", "value": "Tanium abord\u00f3 una vulnerabilidad de consumo de recursos no controlado en Discover."}], "id": "CVE-2026-1224", "lastModified": "2026-06-17T10:15:21.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "3938794e-25f5-4123-a1ba-5cbd7f104512", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1224", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T21:04:57.237600Z", "version": "2.0.3"}}]}, "published": "2026-01-26T18:16:28.850", "references": [{"source": "3938794e-25f5-4123-a1ba-5cbd7f104512", "tags": ["Vendor Advisory"], "url": "https://security.tanium.com/TAN-2026-001"}], "sourceIdentifier": "3938794e-25f5-4123-a1ba-5cbd7f104512", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "3938794e-25f5-4123-a1ba-5cbd7f104512", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T02:40:16.992935+00:00", "value": {"mitigation_remediation": ["Update Tanium Discover to the latest patched version or apply the vendor\u2011provided fix if available.", "Apply the latest Tanium Service Asset patches for versions 4.10.133 and 4.15.129, or upgrade those components to a fixed release.", "Monitor resource utilization of the Discover service and configure alerts or limits to detect abnormal consumption early.", "Limit network exposure of the Discover endpoint by enforcing least privilege and segmenting the network so only authorized internal components can communicate with it."], "summary": {"action": "Apply Patch", "impact": "Denial of Service due to resource exhaustion"}, "threat_synthesis": {"affected_systems": "Affected are Tanium Discover on all versions and Tanium Service Asset versions 4.10.133 and 4.15.129, as indicated by the supplied CPE identifiers.", "description_and_impact": "The vulnerability is an uncontrolled resource consumption flaw in Tanium Discover that can cause excessive CPU or memory usage, potentially degrading or halting the Discover service and impacting other Tanium components. This results in a denial\u2010of\u2010service condition for the affected system.", "risk_and_exploitability": "The base CVSS score is 4.9, indicating moderate severity. The EPSS score is below 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation details are not provided, so the exact attack vector is not clear; it is inferred that internal or authenticated access to Discover is required. In the absence of a public exploit, the risk remains moderate but potential impact is system availability loss."}}}}, "created": "2026-01-27T20:17:34.669443+00:00", "updated": "2026-04-18T02:45:27.284719+00:00", "vendors": ["tanium", "tanium$PRODUCT$tanium"]}