---
id: "CVE-2026-120775"
kind: "vulnerability"
aliases: ["CVE-2026-120775"]
title: "Tanium Deploy: heap buffer overflow lets a user with package-write rights run code; fixed in Deploy 2.36.294 / 2.40.235 / 2.45.322"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Tanium Deploy", "fixed": ["2.36.294", "2.40.235", "2.45.322"], "affected": "< 2.36.294 (2025H1), < 2.40.235 (2025H2), < 2.45.322 (2026H1)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["endpoint-management", "heap-overflow", "self-hosted", "tanium", "tanium-deploy", "vendor"]
not_affected_if: ["auth-required"]
published_at: "2026-11-03T23:17:33+00:00"
first_seen_at: "2026-11-03T23:45:14+00:00"
updated_at: "2026-11-03T23:46:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120775", "first_seen_at": "2026-11-03T23:45:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T23:46:23+00:00"}]
---

# Tanium Deploy: heap buffer overflow lets a user with package-write rights run code; fixed in Deploy 2.36.294 / 2.40.235 / 2.45.322

Tanium advisory TAN-2026-089 describes a heap-based buffer overflow in Deploy (CVSS 7.2). An authenticated Tanium user with the Deploy Software Package write permission could execute unauthorized code in the context of Deploy. Tanium lists no exploitation; none is recorded here. The advisory page does not print the CVE id; it is matched by identical description, score and vector.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Tanium Deploy affected < 2.36.294 (2025H1), < 2.40.235 (2025H2), < 2.45.322 (2026H1) fixed 2.36.294, 2.40.235, 2.45.322

## How to check

In the Tanium Console, check the installed Deploy solution version. Exposed if it is below v2.36.294 (2025H1 train, Update 27), below v2.40.235 (2025H2, Update 17) or below v2.45.322 (2026H1, Update 10). Also review which accounts hold the Deploy Software Package write permission.

## Fix

- Update Deploy to Update 27 (v2.36.294) on 2025H1, Update 17 (v2.40.235) on 2025H2, or Update 10 (v2.45.322) on 2026H1, or later.

## Timeline

- 2026-11-03T23:45:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120775
- 2026-11-03T23:46:23+00:00 analyst — Read Tanium TAN-2026-089 (primary). Matched to the CVE by description/score/vector, since page omits the CVE id. Workarounds section of the page is empty, so none are claimed. X not checked, low-profile vendor bug.

## Documents

- [advisory] TAN-2026-089: Tanium Deploy heap-based buffer overflow https://security.tanium.com/TAN-2026-089

## From the sources

Tanium addressed a heap-based buffer overflow vulnerability in Deploy.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_