A vulnerable code path in Tanium Asset allows an attacker to inject arbitrary SQL statements into the database. The flaw originates from insufficient input sanitization, permitting malicious characters to alter query logic. Successful exploitation could lead to disclosure of confidential data, modification of records, or deletion of data, impacting the confidentiality, integrity, and availability of information managed by the Asset service.

Tanium’s Asset product, including versions 1.32.178, 1.33.268, and 1.36.107, is affected. The vulnerability resides within the Asset component used for inventory management across Tanium deployments.

The vulnerability carries a CVSS score of 6.3, indicating a moderate risk. EPSS shows an exploitation probability of less than 1%, suggesting that while exploitation is unlikely, the risk remains present. The issue is not listed in CISA’s KEV catalog. Likely attack vectors involve unauthenticated injection via exposed web interfaces or API endpoints, assuming an attacker gains network access to the Asset service.