CVE-2026-1224: 
NixOS vulnerability analysis and mitigation

CVE-2026-1224 is an uncontrolled resource consumption vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) in Tanium Discover that can be exploited to cause a denial of service condition. It affects Tanium Discover versions 4.10.0 through 4.10.133 and 4.15.0 through 4.15.129. The vulnerability was published on January 26, 2026, and a patch was made available by March 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, though ENISA rates it at 4.9 (Tanium Advisory).

The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), meaning Tanium Discover fails to impose adequate limits on resource allocation when processing certain network requests. A low-privileged (per NVD) or high-privileged (per ENISA) authenticated attacker with network access can send specially crafted requests that trigger unbounded resource consumption within the Discover service. No user interaction is required to exploit the vulnerability once the attacker has the necessary access level. No public proof-of-concept or detailed technical write-up has been disclosed (Tanium Advisory).

Successful exploitation results in a denial of service condition, rendering the Tanium Discover service unavailable to legitimate users. There is no impact on confidentiality or integrity — only availability is affected. Given Tanium Discover's role in network asset discovery and visibility, its unavailability could impair an organization's ability to monitor and manage endpoint assets (Tanium Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Tanium Advisory).

Tanium has released patched versions addressing this vulnerability. Users should upgrade Tanium Discover to version 4.10.134 or later (for the 4.10.x branch) or 4.15.130 or later (for the 4.15.x branch). As a compensating control, restrict network access to Tanium Discover to trusted administrative sources only, reducing the attack surface to authorized high-privileged users. Monitor affected systems for unusual resource consumption patterns that may indicate exploitation attempts (Tanium Advisory).