Tanium Certificate Manager: Unauthorized code execution vulnerability
Summary
Tanium Certificate Manager, a module of the Tanium endpoint management platform, contains an unauthorized code execution vulnerability (CWE-77, command injection). An authenticated Tanium user with the Ask Dynamic Questions permission could execute unauthorized code on endpoints running the SSL Certificate Subject sensor. The CVSS base score is 8.8 (High). The attacker needs a low-privileged account and no user interaction. Whether the management server or endpoints are internet-reachable is not established by the sources.
Affected
- Tanium Certificate Manager 1.17 to before 1.17.417 (2025H1 release, before Update 26)
- Tanium Certificate Manager 1.18 to before 1.18.368 (2025H2 release, before Update 16)
- Tanium Certificate Manager 1.22 to before 1.22.119 (2026H1 release, before Update 9)
- Earlier branches: Unknown.
Fixed in
- Certificate Manager 1.17.417 (Update 26) and later
- Certificate Manager 1.18.368 (Update 16) and later
- Certificate Manager 1.22.119 (Update 9) and later
Workaround
- None. The vendor advisory lists no workarounds or mitigations.
Exploitation
- Not known to be exploited in the wild, according to OffSeq. No independent confirmation from CISA or another government source was found.
- No public proof of concept was found.
- EPSS: 0.25 % (17th percentile).
- The Canadian Centre for Cyber Security published advisory AV26-1097 on 28 Oct 2026 and recommends prioritizing this flaw.
Our recommendation
- Confirm whether Tanium Certificate Manager is deployed in your environment.
- Check the installed build against the fixed versions and install the update from the Tanium advisory TAN-2026-075.
- Since no workaround exists, plan an early maintenance window.
- Restrict Ask Dynamic Questions permissions to trusted users and monitor for unexpected activity on endpoints.
- Note that VulDB classifies the issue as CWE-285 with CVSS 6.3; the vendor advisory is authoritative.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Tanium Security Bulletin TAN-2026-075 security.tanium.com
- VulDB entry 427493 vuldb.com
- OffSeq Radar threat entry radar.offseq.com
- OffSeq Radar CVE entry radar.offseq.com
- CVE record mirror (threatint) cve.threatint.com
- Canadian Centre for Cyber Security alerts feed www.cyber.gc.ca
- Tanium Certificate Manager product page www.tanium.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:10.
Original description (NVD)
Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.