Tanium End-User Notifications: Local privilege escalation (CVE-2026-108304)
Tanium addressed a local privilege escalation vulnerability in the End-User Notifications component that allows low-privileged users to elevate privileges on affected hosts.
CVE search metadata
CVE search record: CVE-2026-108304. Severity: high. CVSS: 7.8. KEV: no. Product: End-User Notifications. Brief: Tanium End-User Notifications: Local privilege escalation (CVE-2026-108304). Brief link: https://feed.craftedsignal.io/briefs/2026-10-tanium-lpe/
Triage facts
Revision 1- Applicability
- End-User Notifications
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 20:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Tanium has released a patch for a local privilege escalation vulnerability (CVE-2026-108304) affecting the End-User Notifications component. This vulnerability allows an attacker who already possesses low-privileged access to a system to gain elevated privileges. Details regarding the specific exploit path or the vulnerable version range are currently limited.
Impact
The vulnerability carries a CVSS v3.1 base score of 7.8, indicating the potential for successful exploitation to significantly increase a user's privilege level on the host system.
Recommendation
- Inventory all systems running Tanium End-User Notifications to identify exposure.
- Apply the latest security updates provided by Tanium to address CVE-2026-108304 immediately.
- Monitor local system logs for unauthorized attempts to interact with Tanium service processes or modifications to component configuration files by non-administrator users.
Immediate actions
Patch all instances of Tanium End-User Notifications to the latest version.
Threat Hunt
Monitor process creation events for the End-User Notifications service spawning unusual child processes.
Data: Process creation logs (Event ID 1 or equivalent)
Mitigations
Apply Tanium security patches for CVE-2026-108304.
CVE-2026-108304