Tanium Enforce CVE-2026-116662

Exploitation requires the attacker to get a crafted, highly compressed payload into a code path where Tanium Enforce decompresses it (CWE-409 compression bomb); the available sources do not state which Enforce feature, interface, or input performs this decompression, so the exact precondition is not described in the available sources. Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is rated as required and the impact is availability-only (C:N/I:N/A:H), meaning a successful attack causes denial of service rather than data loss or code execution. The principal limiting factor is affected version: only Enforce 3.0 before 3.0.373, 2.10 before 2.10.778, and 2.9 before 2.9.736 are listed as vulnerable, so patched or unaffected deployments are not at risk. Updating to the fixed versions is the remediation the vendor provides.

This is a genuine but bounded availability risk, not a top-tier emergency. The vendor-supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) indicates a remotely reachable, low-complexity condition with no authentication or user interaction and impact limited strictly to availability - CWE-409 (uncontrolled resource consumption via a compression/'zip bomb') is consistent with a denial-of-service outcome rather than data exposure. The vuln.today decision label is 'this_week', signalling a prioritized but non-emergency remediation cadence. No EPSS score, no CISA KEV listing, and no confirmed exploit code are present in the input, so there is no evidence of active or imminent exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' One clear conflict exists: the input Tags label this 'Information Disclosure,' but the CVSS vector sets C:N and I:N with only A:H, and CWE-409 is an availability weakness - the Information Disclosure tag contradicts the authoritative severity data and should be treated as mislabeled. The PR:N / AV:N rating implies remote unauthenticated reach, but the description does not state how the malicious compressed payload is delivered to Enforce, so the precise trigger path is unverified against the vendor advisory.

A remote attacker supplies a maliciously crafted, highly compressed payload that Tanium Enforce decompresses, causing it to expand far beyond its on-disk size and exhaust CPU, memory, or disk on the processing host. This degrades or disables the Enforce service (denial of service); the available sources do not describe the exact ingestion point, and no public exploit code is identified at time of analysis.