Tanium Stream Client CVE-2026-108326

Exploitation targets improper certificate validation in the Tanium Stream Client Extension (cx-stream) and Endpoint Configuration Toolset Solution: the client does not correctly verify the certificate of the party it connects to, so an attacker must be able to intercept or relay that TLS connection (a man-in-the-middle position on the network path), which is the limiting factor reflected by AC:H. The specific trigger - which connection, protocol step, or validation check fails - is not described in the available sources. Exploitation is unauthenticated (PR:N) and requires no user interaction (UI:N), but the need for a privileged network position, rather than a plain remote request, is what constrains real-world exploitability.

This is a moderate-severity issue (CVSS 6.5) that does not rise to emergency priority. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L describes a network-reachable, unauthenticated flaw (PR:N) whose high attack complexity (AC:H) is consistent with CWE-295 improper certificate validation - exploitation generally requires an attacker to occupy a privileged position on the network path between the Stream Client Extension and the host it communicates with, rather than a simple remote request. The impact profile (C:H, I:N, A:L) points to confidentiality loss (interception of sensitive data) with a minor availability effect and no integrity impact. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month', which aligns with the medium CVSS and the absence of exploitation signals - a priority to patch on a normal cycle, not an act_now/emergency item. The main signals (medium CVSS, AC:H, no KEV, no EPSS, no PoC) are consistent with one another; there is no conflict to reconcile. A patch is confirmed available from the vendor.

An attacker who can intercept or redirect network traffic between a Tanium Stream Client Extension and its communication peer (for example on a shared or compromised network segment) presents a certificate the client fails to validate correctly, allowing the attacker to decrypt or read the sensitive data in transit. Because AC:H reflects the need for this privileged man-in-the-middle position, it is not a trivial single-request attack. No public exploit code or PoC reference was provided in the input.