CVE-2026-1344: Tanium Enforce Path Traversal Vulnerability

CVE-2026-1344 Overview

CVE-2026-1344 is an insecure file permissions vulnerability affecting the Tanium Enforce Recovery Key Portal. This vulnerability, classified under CWE-732 (Incorrect Permission Assignment for Critical Resource), allows a local attacker with low privileges to potentially access sensitive information due to improperly configured file permissions.

Critical Impact

Local attackers with basic user privileges could exploit insecure file permissions to gain unauthorized access to sensitive recovery key data, potentially compromising endpoint encryption integrity across the organization.

Affected Products

• Tanium Enforce Recovery Key Portal

Discovery Timeline

• 2026-02-18 - CVE-2026-1344 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-1344

Vulnerability Analysis

This vulnerability stems from improper file permission configuration within the Tanium Enforce Recovery Key Portal component. The vulnerability allows an attacker with local access to the affected system to read sensitive information that should be restricted to privileged users or processes.

The attack requires local access to the system and low-level privileges, but does not require any user interaction to exploit. Notably, the vulnerability has a changed scope, meaning successful exploitation can affect resources beyond the vulnerable component's security authority—potentially allowing access to sensitive recovery keys managed by the portal.

Root Cause

The root cause of this vulnerability is CWE-732: Incorrect Permission Assignment for Critical Resource. During installation or runtime operation, the Tanium Enforce Recovery Key Portal sets overly permissive file system permissions on files containing sensitive data. This allows users with lower privilege levels than intended to read these protected resources.

The misconfiguration typically occurs when file permissions fail to restrict read access to appropriate users or groups, leaving critical recovery key data accessible to any authenticated local user on the system.

Attack Vector

The attack vector is local, requiring the attacker to have authenticated access to the system where the Tanium Enforce Recovery Key Portal is installed. The attacker can then navigate to the affected file locations and read sensitive data that should be protected by proper access controls.

The exploitation process involves identifying improperly secured files within the Recovery Key Portal installation and accessing their contents. Due to the confidentiality impact, successful exploitation could expose encryption recovery keys, potentially undermining the security of endpoint encryption across managed devices.

For detailed technical information, refer to the Tanium Security Advisory TAN-2026-003.

Detection Methods for CVE-2026-1344

Indicators of Compromise

• Unexpected file access events targeting Tanium Enforce Recovery Key Portal directories by non-administrative users
• Audit logs showing read access to recovery key files by unauthorized accounts
• Unusual enumeration of file permissions within Tanium installation directories

Detection Strategies

• Monitor file access events using endpoint detection and response (EDR) solutions like SentinelOne for access to sensitive Tanium directories
• Enable file integrity monitoring (FIM) on critical Tanium Enforce Recovery Key Portal files
• Review Windows Security Event logs for Event ID 4663 (file access attempts) targeting affected directories

Monitoring Recommendations

• Configure SentinelOne Singularity to detect and alert on suspicious file access patterns within Tanium installation paths
• Implement audit policies to log all access attempts to recovery key storage locations
• Regularly audit file permissions on Tanium Enforce components to detect configuration drift

How to Mitigate CVE-2026-1344

Immediate Actions Required

• Review and apply the security patch from Tanium as detailed in Security Advisory TAN-2026-003
• Audit current file permissions on the Tanium Enforce Recovery Key Portal installation
• Restrict local access to systems hosting the Recovery Key Portal to essential personnel only
• Monitor for any indicators of compromise before applying the patch

Patch Information

Tanium has released a security update to address this vulnerability. Administrators should consult the Tanium Security Advisory TAN-2026-003 for specific patch versions and installation instructions. Apply the update following your organization's change management procedures.

Workarounds

• Manually restrict file permissions on affected directories using icacls or equivalent tools to limit access to administrative accounts only
• Implement additional access controls or network segmentation to limit which users can access systems running the Recovery Key Portal
• Deploy SentinelOne to monitor and alert on any suspicious file access attempts targeting the vulnerable component

# Example: Restricting permissions on Windows (adjust path as needed)
icacls "C:\Program Files\Tanium\Enforce Recovery Key Portal" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F"