Four Security Firms Patch Serious Flaws in Their Own Products

Key points

• Tenable patched a critical flaw, tracked as CVE-2026-15265, in Tenable Agent that could let an attacker run malicious code on a victim's machine remotely.
• ESET fixed a high-severity privilege-escalation bug in ESET Inspect Connector for Windows that could let a local attacker gain administrator-level control.
• Tanium warned customers of a high-severity denial-of-service flaw in Tanium Server that an unauthenticated attacker on the same network could trigger.
• Trend Micro patched a high-severity privilege-escalation vulnerability in Cleaner One Pro for Mac that could let attackers delete protected files.

Four cybersecurity companies pushed out urgent fixes this month for serious vulnerabilities in their own software. The irony isn't lost: tools sold to protect businesses needed protecting themselves.

How bad are these flaws, really?

Bad enough that each company urged customers to update immediately. The worst sits inside Tenable Agent, software organisations install on computers to scan for security weaknesses. The flaw, CVE-2026-15265, is a path-traversal vulnerability, meaning an attacker tricks the software into accessing files and folders it should never touch. Tenable confirmed that could lead to remote code execution: an attacker running any commands they like on the affected machine, no physical presence required. We first covered this CVE on 16 July 2026.

ESET's problem lives in ESET Inspect Connector for Windows, a component used for monitoring endpoint devices. It's a local privilege escalation: a criminal who already has limited access to a machine could quietly promote themselves to full administrator. ESET's own advisory says the vulnerable process accepted specially crafted ALPC (Advanced Local Procedure Call) requests without checking their origin, opening access to restricted functionality.

Tanium's issue affects Tanium Server, the central hub organisations use to manage security across thousands of computers. An unauthenticated attacker on the same network could flood it with requests and knock it offline, leaving security teams blind during the outage. No login required.

Trend Micro's Cleaner One Pro for Mac carried a privilege-escalation flaw letting an attacker delete files belonging to Trend Micro itself, potentially stripping away the protections the software is meant to provide.

Should you worry?

None of the four companies have reported confirmed exploitation yet. But Palo Alto Networks and Trend Micro both confirmed real-world attacks against separate vulnerabilities earlier this year, as first reported by SecurityWeek. Our 4 July report on a CISA emergency directive shows how fast that window closes once exploitation begins. Security software is a deliberate target precisely because compromising it can blind the defender at the same moment it opens the door.

If your organisation uses any of these products, apply the available updates now. Confirm with your IT team today whether your versions have been patched.