Tanium Fixes Code Execution, Access Control and Denial-of-Service Vulnerabilities

Tanium issued security bulletins addressing vulnerabilities across its endpoint-management products, including a high-severity unauthorized code execution flaw in Certificate Manager (TAN-2026-075). Other high-severity issues include denial of service in Provision, improper output sanitization in Enforce and Comply, and uncontrolled resource consumption in Enforce. Additional bulletins cover improper access controls, denial of service, resource consumption and insufficient logging in components including Tanium Server and Performance Client Extension.

The Canadian Centre for Cyber Security subsequently published advisory AV26-1097, identifying affected products as Certificate Manager, Endpoint Configuration Toolset Solution, Enforce, Provision, Threat Response, end-user-cx and index-cx. The advisory provides affected-version thresholds for five products but does not specify versions for end-user-cx or index-cx. The Cyber Centre recommends reviewing Tanium’s security advisories and applying necessary updates as they become available. Organizations should inventory affected components and prioritize remediation of the high-severity flaws, particularly the Certificate Manager code execution vulnerability. The supplied notices do not report active exploitation.