Tanium Patch Endpoint Tools is vulnerable to a local privilege escalation flaw that could allow a low privileged user to obtain full system control.

This vulnerability, categorized as CWE-59 (Improper Link Resolution Before File Access), allows a local authenticated user with low privileges to manipulate file operations. By exploiting how the software handles symbolic links, an attacker can trick the application into performing unauthorized actions with higher privileges.

Successful exploitation of this vulnerability permits a local attacker to escalate their privileges to the level of the Tanium service, which typically runs with administrative or system-level authority. Given the CVSS score of 7.8, this represents a high risk because it facilitates lateral movement, unauthorized data access, and full compromise of the affected endpoint, potentially compromising the integrity of the entire Tanium management infrastructure.

Immediate Action: Update Tanium Patch Endpoint Tools to the corrected versions (3.17.10195, 10.1.33, or 10.2.22) immediately to remediate the underlying flaw.

Proactive Monitoring: Review local system logs for unusual file access patterns or unexpected attempts to access protected system directories by non-privileged service accounts.

Compensating Controls: Ensure that the principle of least privilege is strictly enforced on all endpoints, restricting the ability of standard users to create symbolic links or manipulate local file system structures in sensitive directories.

Public Exploit Available: No (exploit_available: false)

The risk posed by local privilege escalation in management software is significant, as it provides a pathway for attackers to bypass standard security boundaries on managed endpoints. System administrators should prioritize testing and deploying the provided patches across their environment to eliminate the vulnerability. Organizations unable to patch immediately should restrict local user access to the extent possible to mitigate the risk of local exploitation.