Cyber Resilience

CVE-2026-2435

Medium

Published: 20 February 2026

Published
20 February 2026
Modified
27 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0024 15.0th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-2435 is a medium-severity SQL Injection (CWE-89) vulnerability in Tanium Asset. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-2435 is a SQL injection vulnerability (CWE-89) affecting the Asset component in Tanium software. Published on 2026-02-20, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating medium severity with network accessibility, low attack complexity, and requirements for low privileges but no user interaction.

An authenticated attacker with low privileges can exploit this vulnerability remotely over the network. Exploitation enables limited impacts on confidentiality, integrity, and availability, allowing potential unauthorized access, modification, or disruption of data through SQL injection techniques.

Tanium has addressed the vulnerability, as detailed in advisory TAN-2026-004 available at https://security.tanium.com/TAN-2026-004, which provides information on patches and mitigation.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

Tanium addressed a SQL injection vulnerability in Asset.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in network-accessible Asset component directly enables remote exploitation of a public-facing application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-15344Same product: Tanium Asset
CVE-2026-9208Same vendor: Tanium
CVE-2026-24956Shared CWE-89
CVE-2026-33615Shared CWE-89
CVE-2025-28939Shared CWE-89
CVE-2021-47872Shared CWE-89
CVE-2025-28873Shared CWE-89
CVE-2019-25636Shared CWE-89
CVE-2026-32611Shared CWE-89
CVE-2026-42755Shared CWE-89

Affected Assets

tanium
asset
1.32 — 1.32.179 · 1.33 — 1.33.269 · 1.36 — 1.36.108

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of all inputs to the Asset component, blocking the unsanitized SQL statements that enable CVE-2026-2435.

SI-2 Flaw Remediation good match
prevent

Mandates prompt application of the vendor patch in TAN-2026-004 that eliminates the SQL injection flaw in Tanium Asset.

AC-6 Least Privilege partial match
prevent

Restricts the low-privilege accounts that the advisory states are sufficient to reach the vulnerable Asset SQL interface, limiting exploit scope.

References