Medium severity · published Oct 27, 2026
CVE-2026-108326
Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.
New
6.5
CVSS
0.2%
EPSS
No
On KEV
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Endpoint Configuration Toolset Solution · Tanium
1.51 before 1.51.60; 1.59 before 1.59.50; 1.71 before 1.71.25 · source: vendor
CX
cx-stream · Tanium
2.4.1184 before 2.4.1184; 2.7.1160 before 2.7.1160; 2.8.1465 before 2.8.1465; 2.9.561 before 2.9.561 · source: vendor