Tanium Enforce CVE-2026-87084

Exploitation requires a valid Tanium platform session at low-privilege level (CVSS PR:L) - unauthenticated network access alone is insufficient. The attack is executable over the network without user interaction or special browser state. No non-default configuration of Enforce appears to be required beyond standard deployment of the module. The primary limiting factor is the need for authenticated access; attackers must first obtain Tanium credentials through credential theft, phishing, or insider access. Organizations using IP-restricted access to the Tanium console reduce the attacker population significantly, while those with Tanium accessible from broad internal segments face wider exposure.

The CVSS 7.7 score is driven primarily by the scope change and high confidentiality impact - the SSRF can extract data from internal systems that the Enforce server can reach, not just the application itself. The PR:L metric confirms that a valid Tanium session is required, limiting opportunistic exploitation to insiders, compromised accounts, or attackers who have already obtained credentials. No CISA KEV listing or public proof-of-concept exists, which places the realistic threat in the targeted or theoretical category rather than active mass exploitation. EPSS data is not included in the provided intelligence, leaving exploitation probability unquantifiable from this dataset; even a mid-sized municipal IT team in olsztyn managing enterprise endpoints via Tanium should treat this as a meaningful patch priority given that Tanium servers routinely hold privileged network positions. The AC:L metric indicates no special timing, race, or configuration preconditions are required, meaning exploitation is straightforward once credentials are obtained.

An authenticated Tanium user with minimal platform privileges submits a crafted request to the Enforce module containing a manipulated URL targeting an internal resource - such as a cloud metadata endpoint or an adjacent internal API - that the Tanium server can reach but the attacker cannot directly access. The Enforce server issues the request on the attacker's behalf and the response, containing sensitive configuration data or access tokens, is returned to the attacker. No public exploit code exists at time of analysis.