{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2408", "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512", "state": "PUBLISHED", "assignerShortName": "Tanium", "dateReserved": "2026-02-12T13:49:49.307Z", "datePublished": "2026-02-19T23:09:51.620Z", "dateUpdated": "2026-03-02T15:55:09.813Z"}, "containers": {"cna": {"affected": [{"product": "Cloud Workloads", "vendor": "Tanium", "versions": [{"version": "1.0.222", "status": "affected", "lessThan": "1.0.222", "versionType": "custom"}], "cpes": ["cpe:2.3:a:tanium:service_cloudworkloads:1.0.221:*:*:*:*:*:*:*"]}], "dateAssigned": "2026-02-12T13:49:48.721Z", "datePublic": "2026-02-19T23:09:40.352Z", "descriptions": [{"lang": "en", "value": "Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "description": "Use After Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512", "shortName": "Tanium", "dateUpdated": "2026-02-19T23:09:51.620Z"}, "references": [{"name": "TAN-2026-005", "url": "https://security.tanium.com/TAN-2026-005"}], "title": "Use-after-free in Cloud Workloads"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T15:54:55.216169Z", "id": "CVE-2026-2408", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T15:55:09.813Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2408", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T15:54:55.216169Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T15:55:02.625Z"}}], "cna": {"title": "Use-after-free in Cloud Workloads", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"cpes": ["cpe:2.3:a:tanium:service_cloudworkloads:1.0.221:*:*:*:*:*:*:*"], "vendor": "Tanium", "product": "Cloud Workloads", "versions": [{"status": "affected", "version": "1.0.222", "lessThan": "1.0.222", "versionType": "custom"}]}], "datePublic": "2026-02-19T23:09:40.352Z", "references": [{"url": "https://security.tanium.com/TAN-2026-005", "name": "TAN-2026-005"}], "dateAssigned": "2026-02-12T13:49:48.721Z", "descriptions": [{"lang": "en", "value": "Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "Use After Free"}]}], "providerMetadata": {"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512", "shortName": "Tanium", "dateUpdated": "2026-02-19T23:09:51.620Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2408", "state": "PUBLISHED", "dateUpdated": "2026-03-02T15:55:09.813Z", "dateReserved": "2026-02-12T13:49:49.307Z", "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512", "datePublished": "2026-02-19T23:09:51.620Z", "assignerShortName": "Tanium"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tanium:cloud_workloads:*:*:*:*:*:*:*:*", "matchCriteriaId": "92362DBC-238B-4862-9D23-84434624F0FB", "versionEndExcluding": "1.0.222", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension."}, {"lang": "es", "value": "Tanium abord\u00f3 una vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n en la extensi\u00f3n de cliente de Cloud Workloads Enforce."}], "id": "CVE-2026-2408", "lastModified": "2026-02-27T21:56:07.003", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "3938794e-25f5-4123-a1ba-5cbd7f104512", "type": "Secondary"}]}, "published": "2026-02-20T00:16:17.930", "references": [{"source": "3938794e-25f5-4123-a1ba-5cbd7f104512", "tags": ["Vendor Advisory"], "url": "https://security.tanium.com/TAN-2026-005"}], "sourceIdentifier": "3938794e-25f5-4123-a1ba-5cbd7f104512", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "3938794e-25f5-4123-a1ba-5cbd7f104512", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.0.222"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Cloud Workloads", "source": "cna", "vendor": "Tanium"}, "product": "service_cloudworkloads", "vendor": "tanium"}], "analysis": {"en": {"generated_at": "2026-04-18T11:39:42.759662+00:00", "value": {"mitigation_remediation": ["Apply the Tanium update that fixes the use\u2011after\u2011free issue in the Cloud Workloads Enforce client extension", "If an immediate update is not available, disable or remove the Enforce client extension until the vendor releases a fix", "Continuously monitor for abnormal activity in the Cloud Workloads environment and keep the system updated with future vendor patches"], "summary": {"action": "Apply Patch", "impact": "Potential memory corruption"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Tanium\u2019s Cloud Workloads product, specifically the Enforce client extension. It is present in the service_cloudworkloads version 1.0.221. No other specific versions are listed in the advisory; vendors are advised to review all releases of the Cloud Workloads service for the presence of the patch that addresses the flaw.", "description_and_impact": "Tanium has identified a use\u2011after\u2011free flaw in the Cloud Workloads Enforce client extension that can corrupt memory. The weakness is categorized as CWE\u2011416. The description does not detail specific exploitation steps, but a use\u2011after\u2011free condition typically permits a malicious entity to manipulate program behavior once the freed memory has been reallocated.", "risk_and_exploitability": "The CVSS score of 4.7 indicates a moderate severity, while the EPSS score of less than 1% reflects a low likelihood of exploitation at this time. The vulnerability is not included in the CISA KEV catalog. Based on the nature of a use\u2011after\u2011free flaw and the absence of explicit attack\u2011vector details, the likely exploitation scenario involves remote interaction with the Cloud Workloads service, potentially requiring crafted input to trigger the memory corruption."}}}}, "created": "2026-02-20T09:53:29.016000+00:00", "updated": "2026-04-18T11:45:44.596829+00:00", "vendors": ["tanium", "tanium$PRODUCT$service_cloudworkloads"]}