--- id: "CVE-2026-121565" kind: "vulnerability" aliases: ["CVE-2026-121565"] title: "Tanium: products trusted certificates from intermediate CAs with compromised keys; fixed in 2025H1 Update 27, 2025H2 Update 17, 2026H1 Update 10" severity: "high" cvss: 7.4 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "TanOS", "fixed": ["1.8.5.0326", "1.8.6.0193", "1.9.0.0089"], "affected": "< 1.8.5.0326 (2025H1); < 1.8.6.0193 (2025H2); < 1.9.0.0089 (2026H1)", "ecosystem": "vendor"}, {"name": "Connect", "fixed": ["5.29.272", "5.37.177", "5.47.135"], "affected": "< 5.29.272; < 5.37.177; < 5.47.135", "ecosystem": "vendor"}, {"name": "Patch", "fixed": ["3.24.328", "3.28.346", "3.32.383"], "affected": "< 3.24.328; < 3.28.346; < 3.32.383", "ecosystem": "vendor"}, {"name": "Provision Host", "fixed": ["10.4.100", "10.8.115", "10.9.113", "10.10.189", "10.11.127"], "affected": "10.4 < 10.4.100; 10.8 < 10.8.115; 10.9 < 10.9.113; 10.10 < 10.10.189; 10.11 < 10.11.127", "ecosystem": "vendor"}, {"name": "cx-stream", "fixed": ["2.4.1187", "2.7.1163", "2.8.1466", "2.9.562"], "affected": "2.4 < 2.4.1187; 2.7 < 2.7.1163; 2.8 < 2.8.1466; 2.9 < 2.9.562", "ecosystem": "vendor"}] ecosystems: [] tags: ["certificate-validation", "self-hosted", "tanium", "tls", "vendor"] not_affected_if: [] published_at: "2026-11-03T23:17:35+00:00" first_seen_at: "2026-11-03T23:45:14+00:00" updated_at: "2026-11-03T23:46:41+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121565", "first_seen_at": "2026-11-03T23:45:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T23:46:41+00:00"}] --- # Tanium: products trusted certificates from intermediate CAs with compromised keys; fixed in 2025H1 Update 27, 2025H2 Update 17, 2026H1 Update 10 Tanium modules and tools accepted certificates from several intermediate CAs whose private keys were compromised, so a network attacker able to intercept traffic (man-in-the-middle) could read and write data. Tanium's fix distrusts those intermediates. No exploitation or workaround is stated. Tanium's bulletin does not name the CAs. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:TanOS affected < 1.8.5.0326 (2025H1); < 1.8.6.0193 (2025H2); < 1.9.0.0089 (2026H1) fixed 1.8.5.0326, 1.8.6.0193, 1.9.0.0089 - vendor:Connect affected < 5.29.272; < 5.37.177; < 5.47.135 fixed 5.29.272, 5.37.177, 5.47.135 - vendor:Patch affected < 3.24.328; < 3.28.346; < 3.32.383 fixed 3.24.328, 3.28.346, 3.32.383 - vendor:Provision Host affected 10.4 < 10.4.100; 10.8 < 10.8.115; 10.9 < 10.9.113; 10.10 < 10.10.189; 10.11 < 10.11.127 fixed 10.4.100, 10.8.115, 10.9.113, 10.10.189, 10.11.127 - vendor:cx-stream affected 2.4 < 2.4.1187; 2.7 < 2.7.1163; 2.8 < 2.8.1466; 2.9 < 2.9.562 fixed 2.4.1187, 2.7.1163, 2.8.1466, 2.9.562 ## How to check In the Tanium Console, list installed solution/module versions and compare to TAN-2026-092: vulnerable if below 2025H1 Update 27, 2025H2 Update 17 or 2026H1 Update 10 builds (e.g. TanOS < 1.8.5.0326 / 1.8.6.0193 / 1.9.0.0089; Connect < 5.29.272 / 5.37.177 / 5.47.135; Patch < 3.24.328 / 3.28.346 / 3.32.383). Also check Provision Host (10.4 < 10.4.100, 10.8 < 10.8.115, 10.9 < 10.9.113, 10.10 < 10.10.189, 10.11 < 10.11.127) and cx-stream (2.4 < 2.4.1187, 2.7 < 2.7.1163, 2.8 < 2.8.1466, 2.9 < 2.9.562). Tanium Cloud and on-prem ECM users: also check the deployed Endpoint Configuration manifest. ## Fix Upgrade every affected Tanium module to 2025H1 Update 27 or later, 2025H2 Update 17 or later, or 2026H1 Update 10 or later (per-module fixed versions in TAN-2026-092). On-prem customers using ECM: also deploy Change Management manifest 2.13.331, 2.21.328 or 2.35.256 or later to all endpoints. Tanium Cloud ECM customers: manifest 2.42.194, 2.44.146, 2.46.120 or 2.48.125 or later. Tanium states no workaround. ## Timeline - 2026-11-03T23:45:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121565 - 2026-11-03T23:46:41+00:00 analyst — Read Tanium bulletin TAN-2026-092 (primary): full product/version list, fixed updates, no workaround. Bulletin does not name the CAs; Tanium's eMudhra blog (16 certs, 8 intermediates) is probably the same event but the bulletin does not say so. Products rows given for main modules only, bulletin lists ~30. ## Documents - [advisory] TAN-2026-092 Tanium security bulletin https://security.tanium.com/TAN-2026-092 - [mentions] eMudhra CA Compromise: Find and Fix Your Exposure with Tanium https://www.tanium.com/blog/emudhra-ca-compromise-find-and-fix-your-exposure-with-tanium ## From the sources Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_