Tanium Cloud Patch Updates & Release Notes

Resolved Issues

• Fixed an issue where patch lists and block lists with a Severity not equal to condition stopped applying on endpoints running Patch CX earlier than 1.11.462, 1.13.963, 1.14.765, 1.15.647, or 1.16.1230. Deployments that used these lists reported Not Applicable, with no error. Patch sends these conditions in a form that earlier Patch CX versions can process. After you upgrade Patch, it republishes the affected patch lists, block lists, and deployments. Ring deployments that were already running aren't republished. If a ring deployment uses a patch list with a Severity not equal to condition and its endpoints run an earlier Patch CX version, recreate the ring deployment, or upgrade Patch CX on those endpoints to the fixed version for its release line or later (1.11.462, 1.13.963, 1.14.765, 1.15.647, or 1.16.1230).

Dependency updates.

Improvements

• Improve Atlas behavior using the Patch API.
• Patch sensors that run VBScript on Windows now include Tanium Scripting Language (TSL) implementations. On Tanium Client 7.9.2 or later with TSL enabled, the client runs the TSL script instead of VBScript; sensor output is unchanged. Endpoints that have not migrated to the Patch client extension return no rows from the TSL path.
• Added a new blocklist for Windows 11 25H2 endpoints (blocking 22H2/23H2/24H2 patch titles) and updates the existing 22H2/23H2/24H2 blocklists to also block 25H2 titles.

Resolved Issues

• Fixed issue that could allow updating a repository's configuration without the required management rights.
• Fixed issue that could cause API requests to return a generic server error instead of a retriable response under high database contention.
• Fixed issue that could cause a patch list rule to match patches that did not match the text entered in the rule.
• Fixed an issue where a weekly maintenance window using a fixed time zone and an evening start time opened one calendar day early on endpoints not running Patch CX, in environments where global maintenance windows are enabled.
• Fixed an issue where a weekly maintenance window using a fixed time zone and an evening start time was enforced one calendar day later than configured on endpoints running Patch CX. Monthly and yearly schedules were corrected previously; this completes the fix for weekly schedules.
• Fixed an issue where a weekly scan window could run one calendar day later than configured when the window used a fixed time zone and its start time crossed midnight UTC. Because scan results feed patch applicability, affected endpoints could report out-of-date applicability for a day.
• Fixed an issue where deleting or updating an automatic deployment configuration could remove version data still needed by its patch list, causing the patch list to repeatedly fail to sync. Patch list version data is now only removed when the patch list itself is deleted, and only when no other deployment still depends on it.
• Fixed issue that could cause retrying an UUP synchronization error to report success without resetting the stuck file.
• Fixed issue that could prevent block list and patch list rule names from being returned when retrieving a list.

Dependency updates.

Improvements

• Deployment pre-notifications are now available without requesting that the capability be enabled for your environment, on any environment where Patch CX has finished rolling out through all Endpoint Configuration upgrade rings. You can configure a pre-deployment end-user notification on manual deployments, deployment templates, and automatic deployment configurations. Endpoints that are not yet running Patch CX are still included in the deployment but do not display a pre-notification; when you enable a pre-notification, the deployment form warns you if the targeted endpoints include any such endpoint.
• Fixed a repo-snapshot issue that could cause the Patch service to hit an out of memory exception when loading certain data, resulting in HTTP 503 errors when navigating the console.
• Fixed an issue where the Patch - Patch List Compliance sensor on Windows did not include the configured Moderate severity minimum age threshold in Compliance (CX) reporting, causing non-default Moderate age settings to be silently ignored on CX-enabled endpoints.

Dependency updates.

Improvements

• After upgrading, Tanium Scan for Windows performs a one-time full metadata resynchronization for WSUS sources to recover any patch metadata missed by previous syncs. No action is required; the first sync after the upgrade may take longer than usual.
• Corrected the Patch API documentation for maintenance window endpoints to accurately reflect existing behavior.
• Improve the performance of the patches API. Listing patches now supports cursor-based pagination, which keeps the cost of each page constant no matter how far through the catalog it is, and no longer recomputes result totals for every page. Retrieving patches also no longer triggers background applicability-data collection as a side effect.
• Patching playbooks and dashboards that only need patch counts (not the full patch list) no longer require an extra parameter to run, fixing an error some Automate playbooks were hitting.
• Prevent some informational statues from producing "Needs Attention" in coverage status.
• Update OpenSuse signing key.
• Added two Tanium Atlas gallery items: Patch Automatic Deployment Configuratons and Patch Automations Needing Attention.
• Added default repositories for Alma Linux 10.
• Added default repositories for SUSE Linux Enterprise 16.
• Added default repositories for Ubuntu 26.04.

Resolved Issues

• Fixed a rare issue where the Tanium Scan for Windows Sync would not complete if the service was killed during a database migration.
• Fixed an issue where PatchCX metadata downloads failed due to URLs missing the required ?product=patch query parameter.
• Fixed an issue where Tanium Scan did not detect recent KBs on Windows Server systems when syncing patch metadata from WSUS.
• Fixed an issue where UUP Sync could falsely report success even though some update content failed to sync to the Tanium Server, causing deployments to fail with a 'Download Failed' deployment status.
• Fixed an issue where updating an automatic deployment configuration's rule criteria through the Atlas API silently reset the patch list's "include superseded patches" setting to false. The setting can now also be updated directly through the Atlas API.
• Fixed an issue where users whose Patch role was scoped only to a custom content set (without access to the built-in "Patch Content Set") could not create new patch lists — they would see an "Insufficient Privileges" error before the create form could load.
• Fixed an issue which caused snapshots to fail if repository variables substitution was unsuccessful for all URLs.
• Fixed issue that could prevent the Patch - Direct Download Statuses sensor from filtering to in-progress downloads only.
• Fixed issue that displayed an incorrect required-permission name for the repository audit log API endpoint in the published API reference.
• Newly-provisioned environments could incorrectly apply block list rules to the "All Patches" patch list, causing available patches to be hidden from the Patches page, from Live/Saved Question results (e.g. PLA, PLAR), and anywhere else that relies on "All Patches" being block-list-agnostic. The "All Patches" patch list is now correctly configured to override block Question results (e.g. PLA, PLAR), and anywhere else that relies on "All Patches" being block-list-agnostic. The "All Patches" patch list is now correctly configured to override block lists at creation time, so all patches are always visible in "All Patches" regardless of any block lists configured on the environment. Existing environments affected by this issue are corrected automatically.
• Patch no longer requests Endpoint Configuration approval for changes it makes itself. Service-generated objects (configuration manifests, required files, always-on maintenance windows, and Tanium-managed blocklists and patch lists) now belong to the Patch Service Objects content set, and the Patch Service Account role now includes bypass-approval for that content set. Existing service-generated objects are moved automatically on upgrade. User-created objects (deployments, patch lists, maintenance windows, blocklists) are unaffected and still require approval. If you use custom Patch roles, add read permission on Patch Service Objects to keep the moved objects visible.
• Restricted vector document access privileges to Patch service accounts only, removing unnecessary permissions from all user-facing Patch roles.
• Fixed an issue where a patch list would fail to sync if it was supplied with an invalid release date filter definition. Patch list validation now rejects these invalid definitions before they can be saved.
• Fixed an issue where opening Patch workbench Configuration Settings would set TSWMaxNumberOfUpdatesPerRequest to '1', which would overwrite the value if saved.
• Fixed an issue where patch list rules using the on-or-after or on-or-before relative-days release date filter matched patches in the opposite direction from what was selected.
• Added a blocklist for a duplicate KB that could cause endpoints to get stuck indefinitely waiting for update metadata after Cumulative Updates for Windows 24H2 and 25H2 was pulled and re-released by Microsoft.

Dependency updates.

Improvements

• Added automated alerting to detect stuck TrendsClient startup, catching a previously silent failure mode.
• After upgrading, Patch now automatically runs a one-time Tanium Scan for Windows sync so that endpoints receive the fix for slow or stuck patch applicability scans without requiring a manual sync from the workbench. The automatic sync at upgrade is skipped in environments where scheduled Tanium Scan for Windows synchronization (the Enable Schedule Synchronization setting) is disabled or where air gap support is enabled; those environments receive the fix at their next manually initiated sync.

Resolved Issues

• Caps individual patch files and urls fields to a limit of 50. Limit is adjustable using the MaxFilesUrlsPerPatch advanced setting
• Database stability improvements.
• Fixed a performance issue where TSW patch compliance scans could time out or appear stuck on endpoints with large update catalogs.

API Version

• Patch Service 3.33.451

Improvements

• Improved service resilience to startup race conditions affecting deployment status reporting.

Resolved issues

• Fixed an issue where monthly, weekly, and yearly recurring schedules could fire on the wrong day for users in negative-UTC time zones when the scheduled time crossed midnight UTC.
• Fixed an issue where some Windows UUP files failed to download due to malformed chunk metadata.
• Fixed an issue which allowed invalid maintenance windows to be created.
• Fixed issue that could prevent the Trends client from starting up properly.
• Fixed an issue where deployments could not be edited.
• Fixed an issue where the Edit button on Ring Deployments was incorrectly enabled, leading to a misleading error when users attempted to save changes.
• Fixed database errors that occurred when processing embedding queues with more than approximately 32,000 pending items.
• Fixed an inconsistency in automatic deploy configuration (ADC) Get responses where override ADCs were counted in filteredTotal and totalCount but not returned as separate items.

Known Issues

• The Patch service and workbench show errors immediately after a Patch Service installation, until service startup completes.

API Version

• Patch Service 3.33.419