{"id":"CVE-2026-121565","title":"Tanium addressed an improper certificate validation vulnerability in multiple products","summary":"Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-295"],"vendor":"Tanium","product":"TanOS","affected":["TanOS >= 1.8.5 < 1.8.5.0326","TanOS >= 1.8.6 < 1.8.6.0193","TanOS >= 1.9.0 < 1.9.0.0089","Asset >= 1.33 < 1.33.334","Asset >= 1.36 < 1.36.182","Asset >= 1.39 < 1.39.164","Comply >= 2.32 < 2.32.275","Comply >= 2.35 < 2.35.337","Comply >= 2.37 < 2.37.347","Connect >= 5.29 < 5.29.272","Connect >= 5.37 < 5.37.177","Connect >= 5.47 < 5.47.135","integrity_monitor >= 3.6 < 3.6.608","integrity_monitor >= 3.7 < 3.7.383","integrity_monitor >= 3.8 < 3.8.362","health_check >= 1.13 < 1.13.653","endpoint_configuration_toolset_solution >= 1.51 < 1.51.61","endpoint_configuration_toolset_solution >= 1.59 < 1.59.51","endpoint_configuration_toolset_solution >= 1.71 < 1.71.26","Patch >= 3.24 < 3.24.328","Patch >= 3.28 < 3.28.346","Patch >= 3.32 < 3.32.383","Performance >= 1.25 < 1.25.196","Reputation >= 6.6 < 6.6.150","Reputation >= 6.7 < 6.7.143","Reputation >= 6.8 < 6.8.167","Reveal >= 2.4 < 2.4.109","Reveal >= 2.5 < 2.5.166","threat_response >= 4.9 < 4.9.480","threat_response >= 4.12 < 4.12.353","threat_response >= 4.17 < 4.17.333","provision_host >= 10.4.100 < 10.4.100","provision_host >= 10.8.115 < 10.8.115","provision_host >= 10.9.113 < 10.9.113","provision_host >= 10.10.189 < 10.10.189","provision_host >= 10.11.127 < 10.11.127"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-06T19:26:46.759376Z"},"published":"2026-11-03","updated":"2026-11-06","sourceUpdated":"2026-11-06T19:26:57.322Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121565","references":[{"url":"https://security.tanium.com/TAN-2026-092","label":"TAN-2026-092"}],"tags":["cve.org"],"epss":0.00163,"epssPercentile":0.05517,"ingestedAt":"2026-11-05T20:33:06.728Z","slug":"CVE-2026-121565","body":"## Overview\n\nTanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.\n\n## Affected\n\n- `TanOS >= 1.8.5 < 1.8.5.0326`\n- `TanOS >= 1.8.6 < 1.8.6.0193`\n- `TanOS >= 1.9.0 < 1.9.0.0089`\n- `Asset >= 1.33 < 1.33.334`\n- `Asset >= 1.36 < 1.36.182`\n- `Asset >= 1.39 < 1.39.164`\n- `Comply >= 2.32 < 2.32.275`\n- `Comply >= 2.35 < 2.35.337`\n- `Comply >= 2.37 < 2.37.347`\n- `Connect >= 5.29 < 5.29.272`\n- `Connect >= 5.37 < 5.37.177`\n- `Connect >= 5.47 < 5.47.135`\n- `integrity_monitor >= 3.6 < 3.6.608`\n- `integrity_monitor >= 3.7 < 3.7.383`\n- `integrity_monitor >= 3.8 < 3.8.362`\n- `health_check >= 1.13 < 1.13.653`\n- `endpoint_configuration_toolset_solution >= 1.51 < 1.51.61`\n- `endpoint_configuration_toolset_solution >= 1.59 < 1.59.51`\n- `endpoint_configuration_toolset_solution >= 1.71 < 1.71.26`\n- `Patch >= 3.24 < 3.24.328`\n- `Patch >= 3.28 < 3.28.346`\n- `Patch >= 3.32 < 3.32.383`\n- `Performance >= 1.25 < 1.25.196`\n- `Reputation >= 6.6 < 6.6.150`\n- `Reputation >= 6.7 < 6.7.143`\n- `Reputation >= 6.8 < 6.8.167`\n- `Reveal >= 2.4 < 2.4.109`\n- `Reveal >= 2.5 < 2.5.166`\n- `threat_response >= 4.9 < 4.9.480`\n- `threat_response >= 4.12 < 4.12.353`\n- `threat_response >= 4.17 < 4.17.333`\n- `provision_host >= 10.4.100 < 10.4.100`\n- `provision_host >= 10.8.115 < 10.8.115`\n- `provision_host >= 10.9.113 < 10.9.113`\n- `provision_host >= 10.10.189 < 10.10.189`\n- `provision_host >= 10.11.127 < 10.11.127`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}