Skip to content

TAN-2026-089

Tanium addressed a heap-based buffer overflow vulnerability in Deploy.

Severity: High

Base Score: 7.2

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Impact

This vulnerability could allow an authenticated Tanium user with the Deploy Software Package write permission to execute unauthorized code in the context of Deploy.

Products Affected

2025H1 Release:

  • Deploy prior to Update 27 (v2.36.0 to v2.36.294)

2025H2 Release:

  • Deploy prior to Update 17 (v2.40.0 to v2.40.235)

2026H1 Release:

  • Deploy prior to Update 10 (v2.45.0 to v2.45.322)

Available Updates

2025H1 Release:

  • Update 27 (Deploy v2.36.294) and later

2025H2 Release:

  • Update 17 (Deploy v2.40.235) and later

2026H1 Release:

  • Update 10 (Deploy v2.45.322) and later

Workaround and Mitigations

None.

Acknowledgements

None.