CVE-2026-11391 is a SQL injection vulnerability in Tanium Patch that arises from improper neutralization of special elements in SQL commands. This flaw affects versions 3.24.0, 3.28.0, and 3.32.0 of the product. The vulnerability has a CVSS 3.1 base score of 6.3 (medium severity), with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality, integrity, and availability at a low level. The vendor has acknowledged the issue but has not yet provided an official fix or remediation details.

Successful exploitation of this vulnerability could allow an attacker with low privileges to perform SQL injection attacks remotely, potentially leading to unauthorized disclosure, modification, or disruption of data within Tanium Patch. The impact is rated as medium severity with limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been announced, users should monitor Tanium's advisories for updates. Until a patch is available, restrict access to the affected versions and apply principle of least privilege to limit potential exploitation.