CVE-2026-15053

Published Jul 8, 2026

Last updated 12 days ago

CVSS high 7.5

Overview

Description
Tanium addressed a denial of service vulnerability in Tanium Server.
Source
3938794e-25f5-4123-a1ba-5cbd7f104512
NVD status
Analyzed
Products
server

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity
HIGH

Weaknesses

3938794e-25f5-4123-a1ba-5cbd7f104512
CWE-789

Social media

Hype score
Not currently trending

  1. 🚨 HIGH Severity Alert CVE-2026-15053: Tanium Server DoS vulnerability (CVSS 7.5) Network-exploitable, no authentication required. Patch immediately to prevent service disruption. #CVE #Vulnerability #PatchNow #ThreatIntel #DFIR https://t.co/gnzZvIRrEt

    @DFIR_Lab

    10 Jul 2026

    45 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthenticated endpoint once approved resulting in disclosure of the victim's vault key and account takeover.•CVE-2026-60104
  2. Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName# or #UserName#, populated from a member's display name), an authenticated member can set their display name to JSON metacharacters and inject arbitrary key-value pairs into the rendered payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints, making injected fields indistinguishable from legitimate template output.•CVE-2026-57522
  3. Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription status, and billing details derived from any target organization's real customer and subscription data.•CVE-2026-57521
  4. Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal path, effectively removing one or more Admin accounts from an organization.•CVE-2026-57520
  5. Tanium addressed a denial of service vulnerability in Tanium Server.•CVE-2026-9156

References

Sources include official advisories and independent security research.