Live › vulnerability › CVE-2026-121565
Tanium modules and tools accepted certificates from several intermediate CAs whose private keys were compromised, so a network attacker able to intercept traffic (man-in-the-middle) could read and write data. Tanium's fix distrusts those intermediates. No exploitation or workaround is stated. Tanium's bulletin does not name the CAs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Organizations running Tanium (on-prem or Tanium Cloud) with affected modules (Asset, Automate, Comply, Connect, Patch, TanOS, Threat Response, Provision, Endpoint Configuration and others) below the fixed updates. Exposure needs an attacker who can intercept network traffic between a Tanium component and a TLS peer. Tanium lists no workaround; customers already on 2025H1 Update 27, 2025H2 Update 17 or 2026H1 Update 10 or later can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| TanOS | vendor | < 1.8.5.0326 (2025H1); < 1.8.6.0193 (2025H2); < 1.9.0.0089 (2026H1) | 1.8.5.0326, 1.8.6.0193, 1.9.0.0089 |
| Connect | vendor | < 5.29.272; < 5.37.177; < 5.47.135 | 5.29.272, 5.37.177, 5.47.135 |
| Patch | vendor | < 3.24.328; < 3.28.346; < 3.32.383 | 3.24.328, 3.28.346, 3.32.383 |
| Provision Host | vendor | 10.4 < 10.4.100; 10.8 < 10.8.115; 10.9 < 10.9.113; 10.10 < 10.10.189; 10.11 < 10.11.127 | 10.4.100, 10.8.115, 10.9.113, 10.10.189, 10.11.127 |
| cx-stream | vendor | 2.4 < 2.4.1187; 2.7 < 2.7.1163; 2.8 < 2.8.1466; 2.9 < 2.9.562 |
| 2.4.1187, 2.7.1163, 2.8.1466, 2.9.562 |
1.8.5.0326 / 1.8.6.0193 / 1.9.0.0089; Connect < 5.29.272 / 5.37.177 / 5.47.135; Patch < 3.24.328 / 3.28.346 / 3.32.383)10.4.100, 10.8 < 10.8.115, 10.9 < 10.9.113, 10.10 < 10.10.189, 10.11 < 10.11.127) and cx-stream (2.4 < 2.4.1187, 2.7 < 2.7.1163, 2.8 < 2.8.1466, 2.9 < 2.9.562)2.13.331, 2.21.328 or 2.35.256 or later to all endpoints2.42.194, 2.44.146, 2.46.120 or 2.48.125 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.
This page as .md · .json · in your agent: get_signal("CVE-2026-121565")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.