Tanium Enforce CVE-2026-116658

Exploitation requires an authenticated low-privileged account on the Tanium platform (CVSS PR:L) with network reachability to the Enforce component (AV:N), with no user interaction needed (UI:N). The exact feature, request, or input that triggers the null pointer dereference is not described in the available sources - the vendor states only that a denial of service was addressed in Enforce. Limiting factors: the requirement for valid authentication confines exploitation to users already granted access to the Tanium console/API, and impact is restricted to availability of the Enforce service (no confidentiality or integrity effect). Affected deployments are Enforce 2.9 before 2.9.736, Enforce 2.10 before 2.10.778, and Enforce 3.0 before 3.0.373; updating to a fixed build is the remediation provided by the vendor.

This is a moderate-severity availability-only issue (CVSS 6.5, A:H with C:N/I:N) representing a null pointer dereference denial of service (CWE-476) in Tanium Enforce. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable flaw with low attack complexity, but PR:L means a low-privileged authenticated account is required, which meaningfully limits the attacker population to users who already have some access to the Tanium environment. There is no CISA KEV listing and no EPSS score was supplied, so there is no signal of active or probable widespread exploitation; likewise no public exploit or PoC reference is present beyond the vendor advisory. The vuln.today decision label is 'this_month', consistent with a real but non-emergency issue: worth remediating on a normal patch cycle rather than an out-of-band rush. Note the impact ceiling - this cannot disclose or alter data, only disrupt the Enforce service - so it is a high-CVSS-for-its-class availability bug rather than a critical compromise vector. The exact trigger mechanism is not described in the available sources (the vendor text only states a DoS was addressed in Enforce).

A user holding a low-privileged authenticated account on the Tanium platform sends a crafted request to the Enforce component over the network, triggering a null pointer dereference that crashes or hangs the service and denies endpoint-enforcement functionality to the organization. No public exploit code or PoC was identified at time of analysis, and the precise crafted input needed is not detailed in the vendor advisory.