Tanium Enforce CVE-2026-116649

Exploitation targets the Tanium Enforce component and, per CVSS UI:R, requires a legitimate user to interact with the maliciously-crafted output (e.g., viewing or exporting affected data in the Enforce console) - this user-interaction requirement is the primary limiting factor. The affected versions are Enforce 2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373; deployments at or above those fixed builds are not affected. The supplied vector marks the flaw network-reachable with no attacker privileges (AV:N/PR:N), but the exact feature, field, or configuration where the unsanitized output is produced is not described in the available sources, and whether injecting the payload itself requires prior authenticated access to Enforce is unverified.

This is a moderate-severity issue (CVSS 7.1) that the vuln.today priority engine rates as 'this_week' rather than an emergency - a reasonable middle-ground. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable, low-complexity flaw needing no attacker privileges but requiring victim user interaction (UI:R), with a scope change and only Low impact to confidentiality, integrity, and availability. No EPSS score, CISA KEV listing, or SSVC exploitation-status data was supplied, and no public exploit or PoC reference appears in the input, so there is no public exploit identified at time of analysis. The CWE (CWE-1236, formula/output neutralization) plus the 'Information Disclosure' tag and 'improper output sanitization' description point to an injection-of-crafted-output class of bug (e.g., content rendered unsafely to another user or export), consistent with the scope change and the required user interaction. The combination - unauthenticated-per-vector but dependent on a victim's action, and only Low triple impact - means this is a genuine but not drop-everything priority; the limiting factor is UI:R. One caveat: the vector lists PR:N, but 'output sanitization' flaws in a management product like Enforce often require authenticated access to inject the payload in the first place; the description does not confirm the trigger, so the true privilege requirement is unverified. Patch availability from the vendor makes remediation the clear priority signal.

An attacker seeds crafted, improperly-sanitized content into Tanium Enforce such that when a legitimate operator later views or exports the affected output in the console, the malicious content is processed, disclosing information or acting within the victim's session (scope change). Exploitation requires that victim interaction (UI:R), and the precise injection point and trigger are not described in the available sources. No public exploit code was identified in the provided data.