Endpoint Configuration Toolset Solution
Monthly
Improper certificate validation in multiple Tanium products causes affected installations to continue trusting several intermediate CA certificates whose private keys are known to be compromised, so an unauthenticated network attacker who holds those keys and can intercept traffic could impersonate trusted endpoints with high confidentiality and integrity impact. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) rates 7.4 High: no privileges or user interaction are needed, but exploitation requires both possession of the compromised intermediate CA keys and a man-in-the-middle position on the network path, which is why complexity is rated High and real-world exploitation is materially constrained. TaniumOS/TanOS, Asset, Comply, Connect, Integrity Monitor, Health Check, Endpoint Configuration Toolset, Patch, Performance and Reputation are all listed as affected; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing).
Local privilege escalation in Tanium End-User CX and the Tanium Endpoint Configuration Toolset Solution lets a user who is already logged on with low privileges raise their rights to a high-impact level (C:H/I:H/A:H) on the affected endpoint, with no user interaction required. Affected builds are end-user-cx releases up to 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 and 1.24.590, plus Endpoint Configuration Toolset Solution 1.51.60, 1.59.50 and 1.71.25; Tanium has released fixes for these branches. No public exploit was identified at time of analysis, and the weakness is classified as CWE-59 link following, although the sources do not describe the precise file or link condition that triggers it. The realistic exposure is a post-compromise scenario on an enterprise agent endpoint rather than a network-facing attack, which is why the priority is 'this_week' rather than emergency action.
Local privilege escalation in Tanium End-User CX and the Endpoint Configuration Toolset Solution allows an authenticated low-privileged user with local access to a managed endpoint to gain high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). The flaw is in the End-User Notifications component and is classified as CWE-59 link following; Tanium reports a vendor patch in advisory TAN-2026-058. This is a credible but non-emergency issue: no public exploit identified at time of analysis, no CISA KEV active-exploitation signal is present in the supplied data, and exploitation requires an existing local foothold.
A heap-based buffer overflow in Tanium's Index component (index-cx), also shipped within the Endpoint Configuration Toolset Solution, allows an attacker who already holds local access and low-level privileges on an endpoint to corrupt heap memory, with the potential for code execution at the integrity level of the affected Index process (CVSS 3.1: 7.8, AV:L/PR:L/AC:L, C/I/A all High, Scope Unchanged). Only hosts running the affected index-cx builds (3.9.x, 3.11.x, 3.14.x, 3.15.x, 3.16.x) or Endpoint Configuration Toolset Solution 1.51, 1.59 and 1.71 branches are exposed; the flaw is not reachable remotely or without credentials per the assessed vector. No public exploit code has been identified at time of analysis and there is no KEV listing, but Tanium has released fixed builds and the issue is prioritized for remediation this week.
Local privilege escalation in Tanium End-User CX (end-user-cx) and the Tanium Endpoint Configuration Toolset Solution lets an attacker who already holds a low-privileged local account on a managed endpoint leverage a link-following flaw (CWE-59) to gain high-integrity code execution, with CVSS 3.1 scoring 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only hosts running the pre-fix builds are exposed - end-user-cx below 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 or 1.24.590, and Endpoint Configuration Toolset Solution below 1.51.60, 1.59.50 or 1.71.25. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor has released fixed builds, and the practical exposure is limited to endpoints that are already multi-user or already partially compromised.
Improper link resolution in the Tanium Threat Response Client Extension (threat-response-cx and the Endpoint Configuration Toolset Solution) allows an authenticated local attacker with low privileges to follow a manipulated link and read or write files outside the intended location, producing high confidentiality and integrity impact with no availability effect. Affected builds include threat-response-cx releases prior to 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271 and 1.21.1673, and Endpoint Configuration Toolset Solution releases prior to 1.51.60, 1.59.50 and 1.71.25. Exploitation is local-only and additionally depends on an unspecified high-complexity condition, so realistic abuse is limited to attackers who already hold a foothold on the endpoint; no public exploit code has been identified at time of analysis.
Local denial of service in the Tanium Performance client extension (performance-cx) and the Tanium Endpoint Configuration Toolset Solution lets a user who already holds low-level privileges on an endpoint exhaust resources in the agent, degrading or halting its availability with no confidentiality or integrity impact. The flaw is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and requires local access to the host, so it is a moderate-severity issue rather than a top-tier priority. Tanium has released fixed builds and no public exploit was identified at time of analysis; priority is this_month.
Tanium Stream Client Extension (cx-stream) and Endpoint Configuration Toolset Solution do not properly validate certificates on the connections they initiate, so an attacker who can intercept or relay TLS traffic can impersonate the peer and disclose information (CVSS 6.5; C:H/I:N/A:L). The issue is unauthenticated (PR:N) and requires no user interaction (UI:N), but exploitation depends on a man-in-the-middle network position, which is reflected by AC:H; no public exploit has been identified at time of analysis. This is a moderate-severity, this_month-priority issue rather than an emergency, and vendor fixes are available per Tanium advisory TAN-2026-060.
Local information disclosure in Tanium Threat Response Client Extension and Endpoint Configuration Toolset Solution is reachable only by a low-privileged local user and depends on a high-complexity condition outside the attacker's control, so impact is limited to low confidentiality exposure and minor availability loss. No public exploit code was identified at time of analysis, and Tanium has published fixed builds under advisory TAN-2026-056.
A use-after-free memory-corruption flaw in the Tanium Threat Response Client Extension requires local access to a host plus pre-existing low-level privileges, and its worst outcome is partial availability loss of the client extension - no confidentiality or integrity impact. Tanium has released fixed builds across the Endpoint Configuration Toolset Solution (1.51, 1.59, 1.71 branches) and multiple threat-response-cx branches per advisory TAN-2026-068. This is a low-priority issue: no public exploit code, PoC reference, or CISA KEV entry is present in the available data, and the priority label is monitor.
Infinite-loop denial of service in Tanium Threat Response client extension and Endpoint Configuration Toolset Solution allows a local user with low privileges to hang the affected endpoint component, reducing availability only. Affected builds are Threat Response CX before 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271, and 1.21.1673, and Endpoint Configuration Toolset Solution before 1.51.60, 1.59.50, and 1.71.25. The vendor has released fixes, no public exploit identified at time of analysis, no CISA KEV entry, and the issue is rated monitor priority.
Endpoint Configuration Toolset Solution is affected by improper link resolution before file access (CVSS 7.8).
Improper certificate validation in multiple Tanium products causes affected installations to continue trusting several intermediate CA certificates whose private keys are known to be compromised, so an unauthenticated network attacker who holds those keys and can intercept traffic could impersonate trusted endpoints with high confidentiality and integrity impact. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) rates 7.4 High: no privileges or user interaction are needed, but exploitation requires both possession of the compromised intermediate CA keys and a man-in-the-middle position on the network path, which is why complexity is rated High and real-world exploitation is materially constrained. TaniumOS/TanOS, Asset, Comply, Connect, Integrity Monitor, Health Check, Endpoint Configuration Toolset, Patch, Performance and Reputation are all listed as affected; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing).
Local privilege escalation in Tanium End-User CX and the Tanium Endpoint Configuration Toolset Solution lets a user who is already logged on with low privileges raise their rights to a high-impact level (C:H/I:H/A:H) on the affected endpoint, with no user interaction required. Affected builds are end-user-cx releases up to 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 and 1.24.590, plus Endpoint Configuration Toolset Solution 1.51.60, 1.59.50 and 1.71.25; Tanium has released fixes for these branches. No public exploit was identified at time of analysis, and the weakness is classified as CWE-59 link following, although the sources do not describe the precise file or link condition that triggers it. The realistic exposure is a post-compromise scenario on an enterprise agent endpoint rather than a network-facing attack, which is why the priority is 'this_week' rather than emergency action.
Local privilege escalation in Tanium End-User CX and the Endpoint Configuration Toolset Solution allows an authenticated low-privileged user with local access to a managed endpoint to gain high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). The flaw is in the End-User Notifications component and is classified as CWE-59 link following; Tanium reports a vendor patch in advisory TAN-2026-058. This is a credible but non-emergency issue: no public exploit identified at time of analysis, no CISA KEV active-exploitation signal is present in the supplied data, and exploitation requires an existing local foothold.
A heap-based buffer overflow in Tanium's Index component (index-cx), also shipped within the Endpoint Configuration Toolset Solution, allows an attacker who already holds local access and low-level privileges on an endpoint to corrupt heap memory, with the potential for code execution at the integrity level of the affected Index process (CVSS 3.1: 7.8, AV:L/PR:L/AC:L, C/I/A all High, Scope Unchanged). Only hosts running the affected index-cx builds (3.9.x, 3.11.x, 3.14.x, 3.15.x, 3.16.x) or Endpoint Configuration Toolset Solution 1.51, 1.59 and 1.71 branches are exposed; the flaw is not reachable remotely or without credentials per the assessed vector. No public exploit code has been identified at time of analysis and there is no KEV listing, but Tanium has released fixed builds and the issue is prioritized for remediation this week.
Local privilege escalation in Tanium End-User CX (end-user-cx) and the Tanium Endpoint Configuration Toolset Solution lets an attacker who already holds a low-privileged local account on a managed endpoint leverage a link-following flaw (CWE-59) to gain high-integrity code execution, with CVSS 3.1 scoring 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only hosts running the pre-fix builds are exposed - end-user-cx below 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 or 1.24.590, and Endpoint Configuration Toolset Solution below 1.51.60, 1.59.50 or 1.71.25. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor has released fixed builds, and the practical exposure is limited to endpoints that are already multi-user or already partially compromised.
Improper link resolution in the Tanium Threat Response Client Extension (threat-response-cx and the Endpoint Configuration Toolset Solution) allows an authenticated local attacker with low privileges to follow a manipulated link and read or write files outside the intended location, producing high confidentiality and integrity impact with no availability effect. Affected builds include threat-response-cx releases prior to 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271 and 1.21.1673, and Endpoint Configuration Toolset Solution releases prior to 1.51.60, 1.59.50 and 1.71.25. Exploitation is local-only and additionally depends on an unspecified high-complexity condition, so realistic abuse is limited to attackers who already hold a foothold on the endpoint; no public exploit code has been identified at time of analysis.
Local denial of service in the Tanium Performance client extension (performance-cx) and the Tanium Endpoint Configuration Toolset Solution lets a user who already holds low-level privileges on an endpoint exhaust resources in the agent, degrading or halting its availability with no confidentiality or integrity impact. The flaw is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and requires local access to the host, so it is a moderate-severity issue rather than a top-tier priority. Tanium has released fixed builds and no public exploit was identified at time of analysis; priority is this_month.
Tanium Stream Client Extension (cx-stream) and Endpoint Configuration Toolset Solution do not properly validate certificates on the connections they initiate, so an attacker who can intercept or relay TLS traffic can impersonate the peer and disclose information (CVSS 6.5; C:H/I:N/A:L). The issue is unauthenticated (PR:N) and requires no user interaction (UI:N), but exploitation depends on a man-in-the-middle network position, which is reflected by AC:H; no public exploit has been identified at time of analysis. This is a moderate-severity, this_month-priority issue rather than an emergency, and vendor fixes are available per Tanium advisory TAN-2026-060.
Local information disclosure in Tanium Threat Response Client Extension and Endpoint Configuration Toolset Solution is reachable only by a low-privileged local user and depends on a high-complexity condition outside the attacker's control, so impact is limited to low confidentiality exposure and minor availability loss. No public exploit code was identified at time of analysis, and Tanium has published fixed builds under advisory TAN-2026-056.
A use-after-free memory-corruption flaw in the Tanium Threat Response Client Extension requires local access to a host plus pre-existing low-level privileges, and its worst outcome is partial availability loss of the client extension - no confidentiality or integrity impact. Tanium has released fixed builds across the Endpoint Configuration Toolset Solution (1.51, 1.59, 1.71 branches) and multiple threat-response-cx branches per advisory TAN-2026-068. This is a low-priority issue: no public exploit code, PoC reference, or CISA KEV entry is present in the available data, and the priority label is monitor.
Infinite-loop denial of service in Tanium Threat Response client extension and Endpoint Configuration Toolset Solution allows a local user with low privileges to hang the affected endpoint component, reducing availability only. Affected builds are Threat Response CX before 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271, and 1.21.1673, and Endpoint Configuration Toolset Solution before 1.51.60, 1.59.50, and 1.71.25. The vendor has released fixes, no public exploit identified at time of analysis, no CISA KEV entry, and the issue is rated monitor priority.
Endpoint Configuration Toolset Solution is affected by improper link resolution before file access (CVSS 7.8).