CVE-2026-121565: Tanium addressed an improper certificate validation vulnerability in multiple products

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Tanium). Independent of NVD's CPE analysis and usually ahead of it.

• Tanium Asset

  • 1.33 and later · before 1.33.334affected
  • 1.36 and later · before 1.36.182affected
  • 1.39 and later · before 1.39.164affected

• Tanium Comply

  • 2.32 and later · before 2.32.275affected
  • 2.35 and later · before 2.35.337affected
  • 2.37 and later · before 2.37.347affected

• Tanium Connect

  • 5.29 and later · before 5.29.272affected
  • 5.37 and later · before 5.37.177affected
  • 5.47 and later · before 5.47.135affected

• Tanium Endpoint Configuration Toolset Solution

  • 1.51 and later · before 1.51.61affected
  • 1.59 and later · before 1.59.51affected
  • 1.71 and later · before 1.71.26affected

• Tanium Health Check

  • 1.13 and later · before 1.13.653affected

• Tanium Integrity Monitor

  • 3.6 and later · before 3.6.608affected
  • 3.7 and later · before 3.7.383affected
  • 3.8 and later · before 3.8.362affected

• Tanium Patch

  • 3.24 and later · before 3.24.328affected
  • 3.28 and later · before 3.28.346affected
  • 3.32 and later · before 3.32.383affected

• Tanium Performance

  • 1.25 and later · before 1.25.196affected

• Tanium Provision Host

  • 10.4.100 and later · before 10.4.100affected · semver
  • 10.8.115 and later · before 10.8.115affected · semver
  • 10.9.113 and later · before 10.9.113affected · semver
  • 10.10.189 and later · before 10.10.189affected · semver
  • 10.11.127 and later · before 10.11.127affected · semver

• Tanium Reputation

  • 6.6 and later · before 6.6.150affected
  • 6.7 and later · before 6.7.143affected
  • 6.8 and later · before 6.8.167affected

• Tanium Reveal

  • 2.4 and later · before 2.4.109affected
  • 2.5 and later · before 2.5.166affected

• Tanium TanOS

  • 1.8.5 and later · before 1.8.5.0326affected
  • 1.8.6 and later · before 1.8.6.0193affected
  • 1.9.0 and later · before 1.9.0.0089affected

Other highest-scoring records for the same primary product.

• CVE-2025-15311Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.
  31Monitor
• CVE-2025-15312Tanium addressed an improper output sanitization vulnerability in TanOS.
  28Monitor
• CVE-2025-13225Tanium addressed an arbitrary file deletion vulnerability in TanOS.
  24Monitor

Published before and after this one in the same product

• ← EarlierCVE-2025-15321Feb 5, 2026 · Tanium addressed an improper input validation vulnerability in Tanium Appliance.
  10Monitor
• ← EarlierCVE-2025-15323Feb 5, 2026 · Tanium addressed an improper certificate validation vulnerability in Tanium Appliance.
  14Monitor
• ← EarlierCVE-2026-2605Feb 19, 2026 · Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS.
  21Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A certificate validation error is silently swallowed instead of terminating the connection. Often, code added for a test environment makes its way into production.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1override fun checkServerTrusted(chain: Array<X509Certificate>, type: String) {2  // Left empty for the test environment3}

1val client = OkHttpClient.Builder()2  .certificatePinner(3    CertificatePinner.Builder()4      .add("api.sirius.example", "sha256/…")5      .build()6  ).build()

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.