Skip to content

TAN-2026-070

Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.

Severity: Medium

Base Score: 5.5

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Impact

This vulnerability could allow an attacker with access to a system running the Tanium Client to perform a denial of service attack against the Tanium Client.

Products Affected

2025H1 Release:

  • Endpoint Configuration Toolset Solution prior to Update 26 (v1.51 to v1.51.60)

2025H2 Release:

  • Endpoint Configuration Toolset Solution prior to Update 16 (v1.59 to v1.59.50)

2026H1 Release:

  • Endpoint Configuration Toolset Solution prior to Update 9 (v1.71 to v1.71.25)

Vulnerable tool versions:

  • performance-cx 2.7 prior to 2.7.648
  • performance-cx 2.8 prior to 2.8.2110
  • performance-cx 2.9 prior to 2.9.1165
  • performance-cx 2.11 prior to 2.11.1312
  • performance-cx 2.13 prior to 2.13.1010
  • performance-cx 2.14 prior to 2.14.56

Available Updates

2025H1 Release:

  • Update 26 (Endpoint Configuration Toolset Solution v1.51.60) and later

2025H2 Release:

  • Update 16 (Endpoint Configuration Toolset Solution v1.59.50) and later

2026H1 Release:

  • Update 9 (Endpoint Configuration Toolset Solution v1.71.25) and later

In addition to upgrading all impacted software, Tanium on-prem customers who use ECM should use Change Management in Endpoint Configuration to deploy one of the following Manifests to all endpoints:

  • 2.13.327 or later
  • 2.21.324 or later
  • 2.35.252 or later

Tanium Cloud customers who use ECM should use Change Management in Endpoint Configuration to deploy one of the following Manifests to all endpoints:

  • 2.40.225 or later
  • 2.42.176 or later
  • 2.44.127 or later
  • 2.46.101 or later

Workaround and Mitigations

None.

Acknowledgements

None.