Skip to content

TAN-2026-068

Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.

Severity: Low

Base Score: 2.5

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Impact

This vulnerability could allow an attacker with access to a system running the Tanium Client to cause Threat Response Client Extension to crash on that particular endpoint.

Products Affected

2025H1 Release:

  • Endpoint Configuration Toolset Solution prior to Update 26 (v1.51 to v1.51.60)

2025H2 Release:

  • Endpoint Configuration Toolset Solution prior to Update 16 (v1.59 to v1.59.50)

2026H1 Release:

  • Endpoint Configuration Toolset Solution prior to Update 9 (v1.71 to v1.71.25)

Vulnerable tool versions:

  • threat-response-cx 1.17 prior to 1.17.802
  • threat-response-cx 1.18 prior to 1.18.2732
  • threat-response-cx 1.19 prior to 1.19.2213
  • threat-response-cx 1.20 prior to 1.20.2271
  • threat-response-cx 1.21 prior to 1.21.1673

Available Updates

2025H1 Release:

  • Update 26 (Endpoint Configuration Toolset Solution v1.51.60) and later

2025H2 Release:

  • Update 16 (Endpoint Configuration Toolset Solution v1.59.50) and later

2026H1 Release:

  • Update 9 (Endpoint Configuration Toolset Solution v1.71.25) and later

In addition to upgrading all impacted software, Tanium on-prem customers who use ECM should use Change Management in Endpoint Configuration to deploy one of the following Manifests to all endpoints:

  • 2.13.327 or later
  • 2.21.324 or later
  • 2.35.252 or later

Tanium Cloud customers who use ECM should use Change Management in Endpoint Configuration to deploy one of the following Manifests to all endpoints:

  • 2.40.225 or later
  • 2.42.176 or later
  • 2.44.127 or later
  • 2.46.101 or later

Workaround and Mitigations

None.

Acknowledgements

None.