CVE-2026-9156: Tanium Server DoS Vulnerability

CVE-2026-9156 Overview

CVE-2026-9156 is a denial of service vulnerability affecting Tanium Server. The flaw is categorized under [CWE-772] (Missing Release of Resource after Effective Lifetime), indicating the server fails to release allocated resources after their useful lifetime ends. An authenticated network attacker with low privileges can trigger the condition without user interaction. Tanium has acknowledged and addressed the issue in its security advisory TAN-2026-013.

Critical Impact

An authenticated remote attacker can exhaust Tanium Server resources, leading to confidentiality impact on the affected service according to the CVSS vector.

Affected Products

• Tanium Server (refer to Tanium Security Advisory TAN-2026-013 for affected versions)

Discovery Timeline

• 2026-05-27 - CVE-2026-9156 published to the National Vulnerability Database (NVD)
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-9156

Vulnerability Analysis

The vulnerability resides in Tanium Server and is classified as a resource management flaw under [CWE-772]. The server fails to release resources allocated during request handling once those resources are no longer needed. Repeated requests cause those resources to accumulate, degrading service availability and exposing sensitive state.

An attacker exploiting this issue must be authenticated to the Tanium Server with low-level privileges. No user interaction is required, and the attack can be launched over the network. The CVSS vector indicates a confidentiality impact rather than direct integrity or availability loss, suggesting the resource leak may expose memory or session-bound information accessible to the attacker.

The Exploit Prediction Scoring System (EPSS) probability of 0.029% (8.686 percentile, as of 2026-05-28) reflects a low likelihood of near-term exploitation. No public proof-of-concept code is available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper cleanup of resources allocated during the lifecycle of authenticated server requests. When the operation completes or terminates abnormally, references to memory, handles, or session-bound objects are retained. Over time, these orphaned allocations accumulate and create observable side effects an attacker can leverage.

Attack Vector

The attack vector is network-based and requires valid low-privilege credentials on the Tanium Server. An authenticated client sends crafted or repeated requests that cause the server to allocate resources it never releases. No physical access or user interaction is necessary.

No verified exploitation code is publicly available. Refer to the Tanium Security Advisory TAN-2026-013 for technical details from the vendor.

Detection Methods for CVE-2026-9156

Indicators of Compromise

• Sustained growth of memory, file handle, or thread counts on Tanium Server processes without corresponding workload increases.
• Repeated authenticated API or console requests from a single low-privilege account targeting the same endpoint.
• Tanium Server response latency increases and intermittent service unavailability.

Detection Strategies

• Baseline normal Tanium Server resource consumption and alert on deviations sustained over time.
• Correlate authentication logs with resource utilization metrics to identify accounts driving abnormal allocation patterns.
• Inspect Tanium Server audit logs for unusual request volumes from low-privilege accounts.

Monitoring Recommendations

• Enable verbose logging of authenticated session activity on Tanium Server and forward logs to a centralized SIEM.
• Monitor process-level memory and handle counts for the Tanium Server service with thresholds tuned to historical norms.
• Track failed and successful authentication events for service accounts with access to Tanium Server APIs.

How to Mitigate CVE-2026-9156

Immediate Actions Required

• Apply the patched Tanium Server release identified in Tanium Security Advisory TAN-2026-013.
• Audit Tanium Server accounts and revoke unnecessary low-privilege access until patching is complete.
• Restrict network reachability of the Tanium Server management interface to trusted administrative networks.

Patch Information

Tanium has addressed the denial of service vulnerability in updated builds of Tanium Server. Administrators should consult the Tanium Security Advisory TAN-2026-013 for the specific fixed versions, upgrade guidance, and verification steps.

Workarounds

• Limit Tanium Server access to authenticated administrators on segmented management networks.
• Rotate credentials for low-privilege Tanium accounts and enforce least-privilege role assignments.
• Schedule controlled Tanium Server restarts to reclaim leaked resources until the patch is applied.

# Configuration example
# Restrict inbound access to the Tanium Server management port
# (replace MGMT_CIDR and TANIUM_PORT with environment-specific values)
iptables -A INPUT -p tcp -s MGMT_CIDR --dport TANIUM_PORT -j ACCEPT
iptables -A INPUT -p tcp --dport TANIUM_PORT -j DROP