Is CVE-2026-108309 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108309 being exploited in the wild.

How severe is CVE-2026-108309?

Medium severity, with a CVSS score of 5.5, published 27 October 2026.

Which products and versions are affected?

Tanium Endpoint Configuration Toolset Solution 2025H1 Release v1.51 to v1.51.60; 2025H2 Release v1.59 to v1.59.50; 2026H1 Release v1.71 to v1.71.25; Tanium Performance Client Extension 2.7 prior to 2.7.648, 2.8 prior to 2.8.2110, 2.9 prior to 2.9.1165, 2.11 prior to 2.11.1312, 2.13 prior to 2.13.1010, 2.14 prior to 2.14.56.

Is there a fix for CVE-2026-108309?

Yes: fixed in Endpoint Configuration Toolset Solution 2025H1 Update 26 (v1.51.60) and later; 2025H2 Update 16 (v1.59.50) and later; 2026H1 Update 9 (v1.71.25) and later. Performance Client Extension versions: 2.7.648, 2.8.2110, 2.9.1165, 2.11.1312, 2.13.1010, 2.14.56 and later.. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108309 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-108309?

Check whether you run Tanium Endpoint Configuration Toolset Solution or Tanium Performance Client Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108309: Tanium Endpoint Configuration Performance Client Extension denial of service

CVE-2026-108309 · Severity: medium · CVSS 5.5 · Published 2026-10-27

Tanium's Endpoint Configuration Toolset contains an uncontrolled resource consumption flaw in the Performance Client Extension that allows a local attacker to crash the Tanium Client, causing service outages. An attacker with access to a compromised system can trigger this denial of service without authentication. Organizations must update to the latest patched versions to prevent disruption of endpoint management and monitoring.

Technologies: Tanium Endpoint Configuration Toolset Solution. Vendors: Tanium.

Quick answers

Is CVE-2026-108309 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108309 being exploited in the wild.
How severe is CVE-2026-108309?: Medium severity, with a CVSS score of 5.5, published 27 October 2026.
Which products and versions are affected?: Tanium Endpoint Configuration Toolset Solution 2025H1 Release v1.51 to v1.51.60; 2025H2 Release v1.59 to v1.59.50; 2026H1 Release v1.71 to v1.71.25; Tanium Performance Client Extension 2.7 prior to 2.7.648, 2.8 prior to 2.8.2110, 2.9 prior to 2.9.1165, 2.11 prior to 2.11.1312, 2.13 prior to 2.13.1010, 2.14 prior to 2.14.56.
Is there a fix for CVE-2026-108309?: Yes: fixed in Endpoint Configuration Toolset Solution 2025H1 Update 26 (v1.51.60) and later; 2025H2 Update 16 (v1.59.50) and later; 2026H1 Update 9 (v1.71.25) and later. Performance Client Extension versions: 2.7.648, 2.8.2110, 2.9.1165, 2.11.1312, 2.13.1010, 2.14.56 and later.. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108309 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-108309?: Check whether you run Tanium Endpoint Configuration Toolset Solution or Tanium Performance Client Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Endpoint Configuration Toolset Solution 2025H1 Update 26 (v1.51.60) and later; 2025H2 Update 16 (v1.59.50) and later; 2026H1 Update 9 (v1.71.25) and later. Performance Client Extension versions: 2.7.648, 2.8.2110, 2.9.1165, 2.11.1312, 2.13.1010, 2.14.56 and later.

Technical details

An uncontrolled resource consumption vulnerability in Tanium Performance Client Extension (performance-cx) allows local attackers with limited privileges to trigger a denial of service condition against the Tanium Client. The vulnerability requires local access but no user interaction; exploitation results in client unavailability and loss of endpoint visibility. Patches are available across all affected major versions.

Affected products

Tanium Endpoint Configuration Toolset Solution 2025H1 Release v1.51 to v1.51.60; 2025H2 Release v1.59 to v1.59.50; 2026H1 Release v1.71 to v1.71.25
Tanium Performance Client Extension 2.7 prior to 2.7.648, 2.8 prior to 2.8.2110, 2.9 prior to 2.9.1165, 2.11 prior to 2.11.1312, 2.13 prior to 2.13.1010, 2.14 prior to 2.14.56

Timeline

2026-10-27: disclosed

References

https://security.tanium.com/TAN-2026-070

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.