Live › vulnerability › CVE-2026-120775
Tanium advisory TAN-2026-089 describes a heap-based buffer overflow in Deploy (CVSS 7.2). An authenticated Tanium user with the Deploy Software Package write permission could execute unauthorized code in the context of Deploy. Tanium lists no exploitation; none is recorded here. The advisory page does not print the CVE id; it is matched by identical description, score and vector.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Tanium customers running Deploy on the 2025H1, 2025H2 or 2026H1 releases at versions below the fixed updates. Exploitation needs an authenticated Tanium account with the Deploy Software Package write permission (CVSS PR:H), so the risk is mostly a compromised or over-privileged console account. Teams not using Deploy can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Tanium Deploy | vendor | < 2.36.294 (2025H1), < 2.40.235 (2025H2), < 2.45.322 (2026H1) | 2.36.294, 2.40.235, 2.45.322 |
v2.36.294 (2025H1 train, Update 27), below v2.40.235 (2025H2, Update 17) or below (2026H1, Update 10)v2.45.322Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tanium addressed a heap-based buffer overflow vulnerability in Deploy.
This page as .md · .json · in your agent: get_signal("CVE-2026-120775")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.