Missing authorization in Tanium Threat Response allows unauthorized suppression-rule changes

Tanium addressed an improper access controls vulnerability in Threat Response.

Tanium identifies the following affected branches:

• Threat Response 4.9 before 4.9.454.
• Threat Response 4.12 before 4.12.324.
• Threat Response 4.17 before 4.17.292.

The CVE record leaves the default status as unknown. Tanium identifies the corresponding update levels as 4.9.454, 4.12.324, and 4.17.292; parallel branches not listed here require separate verification.

This is a CWE-862 missing authorization flaw in Threat Response. An authenticated Tanium user with the Threat Response Intel Write permission can create or modify suppression rules because authorization for that operation is not properly enforced. Network reachability and the absence of user interaction are supported by the record; Tanium does not disclose the specific endpoint or the implementation detail of the missing authorization check. The affected scope is recorded as unchanged, and exploitation requires a highly privileged account. Other implementation details, including the request format and how suppression rules are applied, remain unknown.

• The vulnerability is reachable over the network and does not require user interaction.
• Exploitation requires an authenticated, highly privileged Tanium user, specifically one with the Threat Response Intel Write permission.
• The record describes low attack complexity but does not provide an endpoint, request format, or concrete attack sequence.
• The supplied record marks public exploit as false. It does not establish the actual exploitation status because the known exploited field has no value.

• Integrity: A highly privileged user can create or modify suppression rules without the intended authorization, changing Threat Response configuration.
• Detection and response: Modified rules could cause selected activity to be ignored or handled differently than intended; this is a possible consequence, not a behavior confirmed for every configuration.
• Confidentiality: The record indicates limited confidentiality impact but does not identify specific data that could be accessed.
• Scope and availability: The recorded scope is unchanged and the vulnerability has no recorded availability impact.

The primary operational risk is unauthorized modification of suppression rules by a user who already holds a high-privilege Threat Response permission. Those changes could reduce detection or response coverage for selected activity, depending on the rules created or modified. The record describes limited confidentiality and integrity impact and no availability impact. The supplied evidence does not establish a breach, service outage, or broader compromise.

1. For the Threat Response 4.9 branch, install Update 25, corresponding to Threat Response 4.9.454, or a later release in that branch as specified by Tanium.
2. For the Threat Response 4.12 branch, install Update 15, corresponding to Threat Response 4.12.324, or a later release in that branch.
3. For the Threat Response 4.17 branch, install Update 8, corresponding to Threat Response 4.17.292, or a later release in that branch.
4. After updating, verify the deployed build and confirm that users with the Threat Response Intel Write permission can make only authorized suppression-rule changes.
5. Tanium lists no workaround or mitigation for this vulnerability.

1. Inventory Tanium Threat Response deployments and compare deployed builds with the fixed boundaries listed in the remediation section.
2. Review assignments of the Threat Response Intel Write permission, especially accounts that can create or modify suppression rules.
3. If audit records exist for suppression-rule changes, review unexpected changes by actor, time, or content. Treat this as precautionary review, not as a Tanium-confirmed indicator.
4. The advisory provides no specific log signature or IOC. The absence of suspicious events does not prove that a deployment is unaffected.