CVE-2026-121565

Tanium addressed an improper certificate validation vulnerability in multiple products

Published Nov 3, 2026 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Description

Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Tanium

TanOS

affected

Version	Status	Constraints
`1.8.5`	affected	< 1.8.5.0326
`1.8.6`	affected	< 1.8.6.0193
`1.9.0`	affected	< 1.9.0.0089

Tanium

Asset

affected

Version	Status	Constraints
`1.33`	affected	< 1.33.334
`1.36`	affected	< 1.36.182
`1.39`	affected	< 1.39.164

Tanium

Comply

affected

Version	Status	Constraints
`2.32`	affected	< 2.32.275
`2.35`	affected	< 2.35.337
`2.37`	affected	< 2.37.347

Tanium

Connect

affected

Version	Status	Constraints
`5.29`	affected	< 5.29.272
`5.37`	affected	< 5.37.177
`5.47`	affected	< 5.47.135

Tanium

Integrity Monitor

affected

Version	Status	Constraints
`3.6`	affected	< 3.6.608
`3.7`	affected	< 3.7.383
`3.8`	affected	< 3.8.362

Tanium

Health Check

affected

Version	Status	Constraints
`1.13`	affected	< 1.13.653

Tanium

Endpoint Configuration Toolset Solution

affected

Version	Status	Constraints
`1.51`	affected	< 1.51.61
`1.59`	affected	< 1.59.51
`1.71`	affected	< 1.71.26

Tanium

Patch

affected

Version	Status	Constraints
`3.24`	affected	< 3.24.328
`3.28`	affected	< 3.28.346
`3.32`	affected	< 3.32.383

Tanium

Performance

affected

Version	Status	Constraints
`1.25`	affected	< 1.25.196

Tanium

Reputation

affected

Version	Status	Constraints
`6.6`	affected	< 6.6.150
`6.7`	affected	< 6.7.143
`6.8`	affected	< 6.8.167

Tanium

Reveal

affected

Version	Status	Constraints
`2.4`	affected	< 2.4.109
`2.5`	affected	< 2.5.166

Tanium

Threat Response

affected

Version	Status	Constraints
`4.9`	affected	< 4.9.480
`4.12`	affected	< 4.12.353
`4.17`	affected	< 4.17.333

Tanium

Provision Host

affected

Version	Status	Constraints
`10.4.100`	affected	< 10.4.100
`10.8.115`	affected	< 10.8.115
`10.9.113`	affected	< 10.9.113
`10.10.189`	affected	< 10.10.189
`10.11.127`	affected	< 10.11.127

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.163% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://security.tanium.com/TAN-2026-092

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Nov 3, 2026 10:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.
Title		Tanium addressed an improper certificate validation vulnerability in multiple products
Weaknesses		CWE-295
References		https://security.tanium.com/TAN-2026-092
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}`