EUVD-2026-111248
GHSA-jfm9-cmg3-4cxj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed Enforce service
-
ExploitSend crafted or excessive requests
-
ExecutionTrigger uncontrolled resource consumption
-
ImpactDegrade service availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected component is Tanium Enforce; exploitation requires network reachability to the Enforce service, and per the CVSS vector (AV:N/AC:L/PR:N/UI:N) needs no authentication, no user interaction, and no special attack complexity. The available sources do not describe a required feature toggle, protocol, or non-default configuration, so the specific trigger is not described in the available sources. The principal LIMITING factor is impact scope: only LOW availability is affected (A:L) with no confidentiality or integrity impact, so successful exploitation causes partial service degradation of Enforce rather than system compromise or full outage. Deployments that do not expose the Enforce service to untrusted networks substantially reduce reachability. |
| Impact | This is a moderate-severity denial-of-service issue (CVSS 5.3) whose signals are consistent rather than conflicting. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L describes a network-reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact and only LOW availability impact (CWE-770, uncontrolled resource consumption). The vuln.today decision label is 'this_month' - a routine patch-cycle priority, not act_now or emergency. There is no CISA KEV listing and no exploitation status to confirm active abuse, so this is 'no public exploit identified at time of analysis.' No EPSS score was supplied, so exploitation probability cannot be weighed quantitatively - STATE EXPLICITLY: EPSS is MISSING from the provided data. No POC or exploit reference appears in the input. The only availability impact is LOW (A:L), meaning degraded service rather than full outage, which is why even with an unauthenticated network vector this does not rise to critical. Net: a genuine but non-urgent issue - patch on the normal monthly cycle; it is not a high-CVSS-but-illusory finding, but neither is it an emergency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted or high-volume requests to a network-exposed Tanium Enforce service, triggering uncontrolled resource consumption (CWE-770) that degrades the service's availability. The low attack complexity means no special timing or configuration is needed, but the impact is partial service degradation rather than full compromise. No public exploit code or PoC reference is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Denial of service in Tanium Enforce (2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373) lets unauthenticated remote attackers degrade the Enforce service by consuming a resource that is not bounded or throttled (CWE-770). The CVSS 3.1 score of 5.3 reflects network reachability with low attack complexity and no privileges or user interaction, but impact is confined to low availability with no confidentiality or integrity effect, so successful abuse causes partial service degradation rather than system compromise or full outage. No public exploit code was identified at time of analysis and no CISA KEV entry exists; Tanium has released fixed builds and the advisory is TAN-2026-052.
RemediationAI
Upgrade Tanium Enforce to the fixed build for each branch: 2.9.736 for the 2.9 line, 2.10.778 for the 2.10 line, and 3.0.373 for the 3.0 line, per Tanium advisory TAN-2026-052 (https://security.tanium.com/TAN-2026-052). Vendor-released patch is available, and the vuln.today priority label is this_month, so scheduling within the current monthly patch cycle is consistent with the assessed moderate severity (CVSS 5.3, availability-only impact). Where upgrading cannot be completed immediately, the effective compensating control for this CVE is to reduce reachability: restrict network access to the Enforce service so that only trusted management networks and administrative hosts can reach it, since the vector is AV:N/PR:N and the limiting factor is exposure. The trade-off is that tightening network policy around Enforce may block legitimate operator and console traffic, so allow-lists must be validated against known Tanium client and console sources before enforcement; this measure reduces exposure but does not remove the underlying unbounded-resource weakness, which only the vendor update addresses.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-770, Allocation of Resources Without Limits or Throttling, in Tanium Enforce, the policy-enforcement component of the Tanium endpoint management platform; the CPE cpe:2.3:a:tanium:enforce:*:*:*:*:*:*:*:* confirms the affected product is the Enforce application itself rather than a shared platform library. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L indicates the vulnerable interface is reachable over the network, requires no authentication, no user interaction and no special conditions beyond network reachability to the Enforce service, and that the consequence is limited to reduced availability. The available sources do not describe the specific request pattern, protocol or feature toggle that triggers the resource exhaustion, so the trigger is not described in the available sources; exploitability is bounded mainly by scope of impact (A:L only) and by whether the Enforce service is exposed to untrusted networks.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable, unauthenticated DoS with no user interaction (AV:N/AC:L/PR:N/UI:N); only partial availability degradation (A:L) and no confidentiality or integrity impact.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed a denial of service vulnerability in Enforce.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB