Tanium Platform EUVD-2026-116547

Exploitation requires the attacker to (1) possess or control the compromised intermediate CA private keys that the affected Tanium products improperly continued to trust, and (2) occupy a man-in-the-middle position on the network path to present a certificate chaining to one of those intermediates. These prerequisites - key compromise plus an interception position - are precisely why the CVSS complexity is rated High (AC:H) and materially limit real-world exploitation despite the network vector. The flaw affects multiple Tanium products including TaniumOS/TanOS, Asset, Comply, Connect, Integrity Monitor, Health Check, Endpoint Configuration Toolset, Patch, Performance, and Reputation; the available sources do not describe a specific non-default configuration or feature toggle required beyond use of the affected certificate-trust path.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) scores 7.4 (High) and reflects an unauthenticated, network-reachable flaw with no user interaction but high attack complexity, and high confidentiality and integrity impact with no availability impact - consistent with a certificate-trust (CWE-295) weakness rather than direct code execution. The high attack complexity is the key tempering signal: exploitation is not trivial because it depends on the attacker leveraging the compromised intermediate CA private keys referenced in the advisory, not merely sending traffic. No EPSS score, no CISA KEV listing, and no public PoC or exploit reference were provided, so there is no evidence of active or at-scale exploitation at this time. The vuln.today decision label is 'this_week', indicating a prompt-but-not-emergency remediation priority - which aligns with a high-severity trust-chain issue that lacks confirmed exploitation. Net assessment: a genuine, vendor-reported trust-validation problem worth remediating promptly, but the AC:H rating and absence of EPSS/KEV/PoC signals argue against treating it as an imminent mass-exploitation threat.

An attacker who controls one of the compromised intermediate CA private keys positions themselves on the network path between a Tanium component and its peer, then presents a certificate chaining to that improperly trusted intermediate. Because the affected products fail to distrust those intermediates, the attacker can intercept or tamper with the TLS-protected communication, exposing or altering sensitive data in transit. No public exploit code or PoC reference was provided in the available sources.