CVE-2026-108326: Tanium Stream Client Extension improper certificate validation

CVE-2026-108326 · Severity: medium · CVSS 6.5 · Published 2026-10-27

Tanium's Stream Client Extension, which collects and transmits endpoint telemetry data, does not properly validate TLS certificates. An attacker positioned on the network could intercept communications and view sensitive telemetry data or block security telemetry from reaching monitoring systems, potentially masking endpoint compromise or suspicious activity.

Technologies: Tanium Endpoint Configuration Toolset Solution. Vendors: Tanium.

Quick answers

Is CVE-2026-108326 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-108326 being exploited in the wild.
How severe is CVE-2026-108326?
Medium severity, with a CVSS score of 6.5, published 27 October 2026.
Which products and versions are affected?
Tanium Endpoint Configuration Toolset Solution 2025H1 v1.51 to v1.51.59, 2025H2 v1.59 to v1.59.49, 2026H1 v1.71 to v1.71.24; Tanium Stream Client Extension cx-stream 2.4 prior to 2.4.1184, 2.7 prior to 2.7.1160, 2.8 prior to 2.8.1465, 2.9 prior to 2.9.561.
Is there a fix for CVE-2026-108326?
Yes: fixed in Stream Client Extension: cx-stream 2.4.1184, 2.7.1160, 2.8.1465, 2.9.561 or later; Endpoint Configuration Toolset Solution: 2025H1 Update 26 (v1.51.60) and later, 2025H2 Update 16 (v1.59.50) and later, 2026H1 Update 9 (v1.71.25) and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108326 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-108326?
Check whether you run Tanium Endpoint Configuration Toolset Solution or Tanium Stream Client Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Stream Client Extension: cx-stream 2.4.1184, 2.7.1160, 2.8.1465, 2.9.561 or later; Endpoint Configuration Toolset Solution: 2025H1 Update 26 (v1.51.60) and later, 2025H2 Update 16 (v1.59.50) and later, 2026H1 Update 9 (v1.71.25) and later

Technical details

The vulnerability is an improper certificate validation flaw in Stream Client Extension affecting the cx-stream component. An unauthenticated network-based attacker capable of performing a man-in-the-middle attack can exploit this to read or block TLS-protected endpoint telemetry. The attack requires network position but no authentication or user interaction; patches are available across all affected versions.

Affected products

  • Tanium Stream Client Extension cx-stream 2.4 prior to 2.4.1184, 2.7 prior to 2.7.1160, 2.8 prior to 2.8.1465, 2.9 prior to 2.9.561
  • Tanium Endpoint Configuration Toolset Solution 2025H1 v1.51 to v1.51.59, 2025H2 v1.59 to v1.59.49, 2026H1 v1.71 to v1.71.24

Timeline

  • 2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.