{"id":"CVE-2026-120775","kind":"vulnerability","aliases":["CVE-2026-120775"],"related":[],"title":"Tanium Deploy: heap buffer overflow lets a user with package-write rights run code; fixed in Deploy 2.36.294 / 2.40.235 / 2.45.322","description":"Tanium addressed a heap-based buffer overflow vulnerability in Deploy.","summary":"Tanium advisory TAN-2026-089 describes a heap-based buffer overflow in Deploy (CVSS 7.2). An authenticated Tanium user with the Deploy Software Package write permission could execute unauthorized code in the context of Deploy. Tanium lists no exploitation; none is recorded here. The advisory page does not print the CVE id; it is matched by identical description, score and vector.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Tanium Deploy","fixed":["2.36.294","2.40.235","2.45.322"],"affected":"< 2.36.294 (2025H1), < 2.40.235 (2025H2), < 2.45.322 (2026H1)","ecosystem":"vendor"}],"ecosystems":[],"tags":["endpoint-management","heap-overflow","self-hosted","tanium","tanium-deploy","vendor"],"not_affected_if":["auth-required"],"how_to_check":"In the Tanium Console, check the installed Deploy solution version. Exposed if it is below v2.36.294 (2025H1 train, Update 27), below v2.40.235 (2025H2, Update 17) or below v2.45.322 (2026H1, Update 10). Also review which accounts hold the Deploy Software Package write permission.","fix":"- Update Deploy to Update 27 (v2.36.294) on 2025H1, Update 17 (v2.40.235) on 2025H2, or Update 10 (v2.45.322) on 2026H1, or later.","status":"open","published_at":"2026-11-03T23:17:33+00:00","first_seen_at":"2026-11-03T23:45:14+00:00","triaged_at":"2026-11-03T23:45:33+00:00","updated_at":"2026-11-03T23:46:23+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-03T23:45:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Tanium Deploy: heap buffer overflow may let attackers run code","impact":"high","summary":"Tanium Deploy has a heap-based buffer overflow, a memory corruption flaw in how it handles data. The sources do not say what an attacker gets beyond the memory corruption itself, though CVSS 7.2 rates it high.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["tanium","tanium-deploy","endpoint-management"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Memory corruption in Deploy; code execution not confirmed by sources","analyst_note":"Find the Tanium advisory for CVE-2026-120775 to confirm affected versions, fixed versions, and attack preconditions (https://nvd.nist.gov/vuln/detail/CVE-2026-120775).","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Tanium Deploy. The sources do not state the affected versions, the configuration needed, or the attack path.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00063,"input_tokens":4044,"output_tokens":451,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Tanium advisory for CVE-2026-120775 to confirm affected versions, fixed versions, and attack preconditions (https://nvd.nist.gov/vuln/detail/CVE-2026-120775).","search":"'-089':48B '-120775':24A,27A '-2026':23A,26A,47B '2.36.294':19A '2.40.235':20A '2.45.322':21A '7.2':59B 'address':107C 'advisori':45B,89B 'authent':61B 'base':53B,111C 'buffer':4A,54B,112C 'code':15A,74B 'context':77B 'could':71B 'cve':22A,25A,95B 'cvss':58B 'deploy':2A,18A,29A,42B,57B,66B,79B,116C 'describ':49B 'descript':102B 'endpoint':31B 'endpoint-manag':30B 'execut':72B 'exploit':83B 'fix':16A 'heap':3A,34B,52B,110C 'heap-bas':51B,109C 'heap-overflow':33B 'host':38B 'id':96B 'ident':101B 'let':6A 'list':81B 'manag':32B 'match':99B 'none':84B 'overflow':5A,35B,55B,113C 'packag':11A,68B 'package-writ':10A 'page':90B 'permiss':70B 'print':93B 'record':86B 'right':13A 'run':14A 'score':103B 'self':37B 'self-host':36B 'softwar':67B 'tan':46B 'tanium':1A,28A,39B,41B,44B,62B,80B,106C 'tanium-deploy':40B 'unauthor':73B 'user':8A,63B 'vector':105B 'vendor':43B 'vulner':114C 'write':12A,69B","nicknames":[],"mitigations":[],"who_affected":"Tanium customers running Deploy on the 2025H1, 2025H2 or 2026H1 releases at versions below the fixed updates. Exploitation needs an authenticated Tanium account with the Deploy Software Package write permission (CVSS PR:H), so the risk is mostly a compromised or over-privileged console account. Teams not using Deploy can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T23:46:23Z","by":"analyst","doc":"https://security.tanium.com/TAN-2026-089","run_id":1580},"products":{"at":"2026-11-03T23:46:23Z","by":"analyst","doc":"https://security.tanium.com/TAN-2026-089","run_id":1580},"who_affected":{"at":"2026-11-03T23:46:23Z","by":"analyst","doc":"https://security.tanium.com/TAN-2026-089","run_id":1580}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["deploy","taniumdeploy"],"ptokens":["deploy","tanium"],"labels":["endpointmanagement","heapoverflow","high","selfhosted","tanium","taniumdeploy","vendor"],"campaign_type":null,"first_public_at":"2026-11-03T23:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"3938794e-25f5-4123-a1ba-5cbd7f104512","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120775","severity":null,"published_at":"2026-11-03T23:17:33+00:00","modified_at":"2026-11-03T23:17:33+00:00","first_seen_at":"2026-11-03T23:45:14+00:00","fetched_at":"2026-11-03T23:45:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120775:1580","url":null,"severity":null,"published_at":"2026-11-03T23:46:23+00:00","modified_at":"2026-11-03T23:46:23+00:00","first_seen_at":"2026-11-03T23:46:23+00:00","fetched_at":"2026-11-03T23:46:23+00:00","note":"Read Tanium TAN-2026-089 (primary). Matched to the CVE by description/score/vector, since page omits the CVE id. Workarounds section of the page is empty, so none are claimed. X not checked, low-profile vendor bug."}],"documents":[{"id":61707,"url":"https://security.tanium.com/TAN-2026-089","title":"TAN-2026-089: Tanium Deploy heap-based buffer overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}