{"id":"CVE-2026-121565","kind":"vulnerability","aliases":["CVE-2026-121565"],"related":[],"title":"Tanium: products trusted certificates from intermediate CAs with compromised keys; fixed in 2025H1 Update 27, 2025H2 Update 17, 2026H1 Update 10","description":"Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.","summary":"Tanium modules and tools accepted certificates from several intermediate CAs whose private keys were compromised, so a network attacker able to intercept traffic (man-in-the-middle) could read and write data. Tanium's fix distrusts those intermediates. No exploitation or workaround is stated. Tanium's bulletin does not name the CAs.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TanOS","fixed":["1.8.5.0326","1.8.6.0193","1.9.0.0089"],"affected":"< 1.8.5.0326 (2025H1); < 1.8.6.0193 (2025H2); < 1.9.0.0089 (2026H1)","ecosystem":"vendor"},{"name":"Connect","fixed":["5.29.272","5.37.177","5.47.135"],"affected":"< 5.29.272; < 5.37.177; < 5.47.135","ecosystem":"vendor"},{"name":"Patch","fixed":["3.24.328","3.28.346","3.32.383"],"affected":"< 3.24.328; < 3.28.346; < 3.32.383","ecosystem":"vendor"},{"name":"Provision Host","fixed":["10.4.100","10.8.115","10.9.113","10.10.189","10.11.127"],"affected":"10.4 < 10.4.100; 10.8 < 10.8.115; 10.9 < 10.9.113; 10.10 < 10.10.189; 10.11 < 10.11.127","ecosystem":"vendor"},{"name":"cx-stream","fixed":["2.4.1187","2.7.1163","2.8.1466","2.9.562"],"affected":"2.4 < 2.4.1187; 2.7 < 2.7.1163; 2.8 < 2.8.1466; 2.9 < 2.9.562","ecosystem":"vendor"}],"ecosystems":[],"tags":["certificate-validation","self-hosted","tanium","tls","vendor"],"not_affected_if":[],"how_to_check":"In the Tanium Console, list installed solution/module versions and compare to TAN-2026-092: vulnerable if below 2025H1 Update 27, 2025H2 Update 17 or 2026H1 Update 10 builds (e.g. TanOS < 1.8.5.0326 / 1.8.6.0193 / 1.9.0.0089; Connect < 5.29.272 / 5.37.177 / 5.47.135; Patch < 3.24.328 / 3.28.346 / 3.32.383). Also check Provision Host (10.4 < 10.4.100, 10.8 < 10.8.115, 10.9 < 10.9.113, 10.10 < 10.10.189, 10.11 < 10.11.127) and cx-stream (2.4 < 2.4.1187, 2.7 < 2.7.1163, 2.8 < 2.8.1466, 2.9 < 2.9.562). Tanium Cloud and on-prem ECM users: also check the deployed Endpoint Configuration manifest.","fix":"Upgrade every affected Tanium module to 2025H1 Update 27 or later, 2025H2 Update 17 or later, or 2026H1 Update 10 or later (per-module fixed versions in TAN-2026-092). On-prem customers using ECM: also deploy Change Management manifest 2.13.331, 2.21.328 or 2.35.256 or later to all endpoints. Tanium Cloud ECM customers: manifest 2.42.194, 2.44.146, 2.46.120 or 2.48.125 or later. Tanium states no workaround.","status":"open","published_at":"2026-11-03T23:17:35+00:00","first_seen_at":"2026-11-03T23:45:14+00:00","triaged_at":"2026-11-03T23:45:32+00:00","updated_at":"2026-11-03T23:46:41+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-03T23:45:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update affected Tanium products to the versions that distrust the listed intermediate CA certificates; the sources do not name the versions.","reach":"network","title":"Tanium: improper certificate validation in several products, fixed by distrusting CAs","impact":"high","summary":"Tanium products accepted certificates issued by several intermediate certificate authorities whose private keys were compromised. Tanium updated the products to stop trusting those intermediate CA certificates.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["tanium","self-hosted"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker with a compromised CA key may impersonate trusted Tanium endpoints","analyst_note":"Find the list of affected Tanium products, versions and the distrusted intermediate CA certificates at https://nvd.nist.gov/vuln/detail/CVE-2026-121565 or Tanium's advisory.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running the affected Tanium products, where certificate trust decisions depend on the intermediate CA certificates that were distrusted. The sources do not list the affected products or versions, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":4068,"output_tokens":491,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the list of affected Tanium products, versions and the distrusted intermediate CA certificates at https://nvd.nist.gov/vuln/detail/CVE-2026-121565 or Tanium's advisory.","search":"'-121565':24A,27A '-2026':23A,26A '10':21A '17':18A '2025h1':13A '2025h2':16A '2026h1':19A '27':15A 'abl':64B 'accept':49B 'address':99C 'associ':118C 'attack':63B 'bulletin':92B 'ca':116C 'cas':7A,54B,97B 'certif':4A,37B,50B,102C,117C 'certificate-valid':36B 'compromis':9A,59B,120C 'connect':29A 'could':73B 'cve':22A,25A 'cx':34A 'cx-stream':33A 'data':77B 'distrust':81B,113C 'exploit':85B 'fix':11A,80B 'host':32A,41B 'improp':101C 'intercept':66B 'intermedi':6A,53B,83B,115C 'key':10A,57B,122C 'man':69B 'man-in-the-middl':68B 'middl':72B 'modul':46B 'multipl':106C 'name':95B 'network':62B 'patch':30A 'privat':56B,121C 'product':2A,107C,108C 'provision':31A 'read':74B 'self':40B 'self-host':39B 'sever':52B,114C 'state':89B 'stream':35A 'tanium':1A,42B,45B,78B,90B,98C 'tanos':28A 'tls':43B 'tool':48B 'traffic':67B 'trust':3A 'updat':14A,17A,20A,111C 'valid':38B,103C 'vendor':44B 'vulner':104C 'whose':55B 'workaround':87B 'write':76B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Tanium (on-prem or Tanium Cloud) with affected modules (Asset, Automate, Comply, Connect, Patch, TanOS, Threat Response, Provision, Endpoint Configuration and others) below the fixed updates. Exposure needs an attacker who can intercept network traffic between a Tanium component and a TLS peer. Tanium lists no workaround; customers already on 2025H1 Update 27, 2025H2 Update 17 or 2026H1 Update 10 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T23:46:41Z","by":"analyst","doc":"https://security.tanium.com/TAN-2026-092","run_id":1579},"workarounds":{"at":"2026-11-03T23:46:41Z","by":"analyst","doc":"https://security.tanium.com/TAN-2026-092","run_id":1579},"how_to_check":{"at":"2026-11-03T23:46:41Z","by":"analyst","doc":"https://security.tanium.com/TAN-2026-092","run_id":1579},"who_affected":{"at":"2026-11-03T23:46:41Z","by":"analyst","doc":"https://security.tanium.com/TAN-2026-092","run_id":1579}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["connect","cxstream","host","patch","provisionhost","tanos"],"ptokens":["connect","cx","host","patch","provision","stream","tanos"],"labels":["certificatevalidation","high","selfhosted","tanium","tls","vendor"],"campaign_type":null,"first_public_at":"2026-11-03T23:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"3938794e-25f5-4123-a1ba-5cbd7f104512","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121565","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121565","severity":null,"published_at":"2026-11-03T23:17:35+00:00","modified_at":"2026-11-03T23:17:35+00:00","first_seen_at":"2026-11-03T23:45:14+00:00","fetched_at":"2026-11-03T23:45:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121565:1579","url":null,"severity":null,"published_at":"2026-11-03T23:46:41+00:00","modified_at":"2026-11-03T23:46:41+00:00","first_seen_at":"2026-11-03T23:46:41+00:00","fetched_at":"2026-11-03T23:46:41+00:00","note":"Read Tanium bulletin TAN-2026-092 (primary): full product/version list, fixed updates, no workaround. Bulletin does not name the CAs; Tanium's eMudhra blog (16 certs, 8 intermediates) is probably the same event but the bulletin does not say so. Products rows given for main modules only, bulletin lists ~30."}],"documents":[{"id":61708,"url":"https://security.tanium.com/TAN-2026-092","title":"TAN-2026-092 Tanium security bulletin","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":61709,"url":"https://www.tanium.com/blog/emudhra-ca-compromise-find-and-fix-your-exposure-with-tanium","title":"eMudhra CA Compromise: Find and Fix Your Exposure with Tanium","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}