---
id: "CVE-2026-108303"
kind: "vulnerability"
aliases: ["CVE-2026-108303"]
title: "Tanium Certificate Manager: unauthorized code execution flaw patched"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Tanium Certificate Manager", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}]
ecosystems: []
tags: ["certificate-manager", "self-hosted", "tanium", "vendor"]
not_affected_if: []
published_at: "2026-10-27T18:17:31+00:00"
first_seen_at: "2026-10-27T18:32:58+00:00"
updated_at: "2026-10-27T18:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108303", "first_seen_at": "2026-10-27T18:32:58+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T18:38:52+00:00"}]
---

# Tanium Certificate Manager: unauthorized code execution flaw patched

Tanium has fixed a flaw in its Certificate Manager that allows unauthorized code execution. The sources do not say which versions are affected or what an attacker needs to reach it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Tanium Certificate Manager affected unknown fixed ?

## How to check

Unknown. Compare your installed Certificate Manager version in the Tanium Console (Administration > Solutions) with the fixed version in Tanium's advisory at security.tanium.com or the Tanium Resource Center, which is not yet found.

## Fix

- Apply the Tanium Certificate Manager update Tanium published for this issue; the sources do not name the fixed version.

## Timeline

- 2026-10-27T18:32:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108303
- 2026-10-27T18:38:52+00:00 analyst — Tanium's per-CVE advisory (security.tanium.com TAN-2026-xxx) not found by search; index page shows only dates. Sibling Tanium advisories (Connect, Comply) describe authenticated-user code execution, with CVSS vector matching this one (PR:L), but that is not confirmed for Certificate Manager. Cloud release notes (Oct 13 and Oct 16, 2026) mention a security update, no versions. Nothing marked verified.

## Documents

- [mentions] Tanium Cloud Release Notes Certificate Manager https://kb.tanium.com/Tanium_Cloud_Release_Notes_Certificate_Manager

## From the sources

Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_