CVE-2026-9208

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Tanium addressed an unauthorized code execution vulnerability in Connect.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
May 27, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-920815.9fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via replyCVE-2026-920826.3By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. ToCVE-2026-920849.1The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in aCVE-2026-920855.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. LCVE-2026-920878.1@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions CVE-2026-920888.6Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation. ThCVE-2026-92099.8mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the rCVE-2026-920915.9A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(CVE-2026-920979.1The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 ThCVE-2026-920996.5The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier beforeCVE-2026-92104.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-921036.3Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client h
CVE-2026-9208: High severity, CVSS 8.8 | Vulnix