CVE-2026-75476: Tanium Threat Response DOS Vulnerability

CVE-2026-75476 Overview

CVE-2026-75476 is a compression bomb vulnerability in Tanium Threat Response. The flaw falls under CWE-409, which covers improper handling of highly compressed data. An attacker with low privileges can supply a specially crafted compressed payload that expands to consume disproportionate resources during decompression. Successful exploitation degrades availability of the affected component but does not impact confidentiality or integrity. Tanium has addressed the issue and documented the fix in Tanium Security Advisory TAN-2026-021.

Critical Impact
Low-privileged network attackers can trigger resource exhaustion in Tanium Threat Response by submitting maliciously compressed input, causing localized availability degradation.

Affected Products

Tanium Threat Response (see vendor advisory for affected versions)

Discovery Timeline

2026-08-19 - CVE-2026-75476 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75476

Vulnerability Analysis

The vulnerability is a compression bomb condition in Tanium Threat Response. Compression bombs are small archives or compressed payloads that expand to enormous sizes when processed. When the affected component decompresses attacker-supplied content without enforcing strict output size or resource limits, the decompression routine consumes excessive memory, CPU, or disk. This produces a partial denial of service against the affected process or host. The attack requires network access and low-level authenticated access, but no user interaction. Exploitation complexity is elevated because the attacker must craft a payload accepted by the parsing pipeline and time it to reach a vulnerable decompression path.

Root Cause

The root cause is improper handling of highly compressed data [CWE-409]. The affected code path does not validate the ratio between input and decompressed output, nor does it apply hard ceilings on decompressed size, memory usage, or processing time before completing decompression.

Attack Vector

An authenticated attacker delivers a crafted compressed artifact over the network to a Threat Response ingestion or processing endpoint. When the service decompresses the artifact, its resource consumption spikes. Repeated submissions can amplify the impact and degrade service availability. Because impact is limited to availability, the vulnerability does not yield code execution or data exposure. Technical specifics are restricted to what Tanium publishes in the vendor advisory.

Detection Methods for CVE-2026-75476

Indicators of Compromise

Sudden spikes in memory or CPU utilization on hosts running Tanium Threat Response components without corresponding operational workload.
Disk consumption growth in temporary or working directories used by Threat Response decompression routines.
Repeated ingestion of unusually small compressed payloads from a single authenticated identity within a short window.

Detection Strategies

Baseline normal Threat Response process resource consumption and alert on statistical deviations tied to decompression activity.
Inspect application and service logs for decompression errors, aborted operations, or out-of-memory conditions on Threat Response nodes.
Correlate authentication events with ingestion telemetry to identify low-privileged accounts submitting anomalous compressed content.

Monitoring Recommendations

Monitor host-level telemetry (memory pressure, page faults, process restarts) on servers hosting Threat Response.
Track ingestion API request rates and payload metadata for outliers in compression ratio.
Review Tanium audit logs for actions performed by low-privileged operator accounts against Threat Response endpoints.

How to Mitigate CVE-2026-75476

Immediate Actions Required

Apply the update referenced in Tanium Security Advisory TAN-2026-021 to all Threat Response deployments.
Audit accounts with access to Threat Response ingestion endpoints and remove unnecessary privileges.
Restrict network reachability of Threat Response services to trusted management segments only.

Patch Information

Tanium has released a fix for CVE-2026-75476 in Threat Response. Administrators should consult Tanium Security Advisory TAN-2026-021 for the specific fixed versions and upgrade guidance. No public exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Workarounds

Enforce resource limits (memory, CPU, disk quotas) on the operating system or container hosting Threat Response until patches are deployed.
Rate-limit ingestion of compressed artifacts at the network or reverse-proxy layer.
Increase monitoring sensitivity on Threat Response hosts to detect resource-exhaustion attempts early.

bash

# Example: cgroup v2 resource ceiling for a Threat Response service unit
# Adjust values to match host capacity and vendor guidance
systemctl set-property tanium-threat-response.service \
    MemoryMax=4G \
    CPUQuota=200% \
    TasksMax=2048