Provision Host
Monthly
Improper certificate validation in multiple Tanium products causes affected installations to continue trusting several intermediate CA certificates whose private keys are known to be compromised, so an unauthenticated network attacker who holds those keys and can intercept traffic could impersonate trusted endpoints with high confidentiality and integrity impact. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) rates 7.4 High: no privileges or user interaction are needed, but exploitation requires both possession of the compromised intermediate CA keys and a man-in-the-middle position on the network path, which is why complexity is rated High and real-world exploitation is materially constrained. TaniumOS/TanOS, Asset, Comply, Connect, Integrity Monitor, Health Check, Endpoint Configuration Toolset, Patch, Performance and Reputation are all listed as affected; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing).
Improper certificate validation in multiple Tanium products causes affected installations to continue trusting several intermediate CA certificates whose private keys are known to be compromised, so an unauthenticated network attacker who holds those keys and can intercept traffic could impersonate trusted endpoints with high confidentiality and integrity impact. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) rates 7.4 High: no privileges or user interaction are needed, but exploitation requires both possession of the compromised intermediate CA keys and a man-in-the-middle position on the network path, which is why complexity is rated High and real-world exploitation is materially constrained. TaniumOS/TanOS, Asset, Comply, Connect, Integrity Monitor, Health Check, Endpoint Configuration Toolset, Patch, Performance and Reputation are all listed as affected; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing).