Tanium Becomes a CVE Numbering Authority

Tanium’s new role as a CVE Numbering Authority signals a step forward in how the company approaches vulnerability management. By joining the CVE Program, Tanium now has the responsibility to identify and publish vulnerabilities found in its SaaS and on-premises products, along with the details needed for remediation. It’s a clear acknowledgment that transparency and accountability are central to any modern security program.

This move also reflects how embedded Tanium has become in the broader security community. Contributing directly to the CVE catalog means the company isn’t just managing issues internally - it’s helping shape how the industry tracks and discusses vulnerabilities. The ability to issue its own CVE IDs tightens the feedback loop between researchers, practitioners, and Tanium’s own customers, giving everyone clearer insight into potential risks.

The authorization comes on top of the security standards Tanium already adheres to, such as ISO certifications, SOC2, and federal compliance frameworks like FedRAMP and GovRAMP. These benchmarks are part of how the company reinforces trust with customers who rely on Tanium for visibility, control, and response across large and distributed environments.

Becoming a CNA doesn’t change Tanium’s mission, but it does deepen its commitment to responsible disclosure and open communication. As the company continues strengthening its platform and processes, its participation in the CVE Program adds another layer of transparency that benefits both its customers and the industry at large.