Tanium Enforce CVE-2026-87088

Exploitation requires a local presence on the endpoint running Tanium Enforce (AV:L) - remote network-based exploitation is not indicated by the CVSS vector. User interaction (UI:R) must occur, meaning some action by a local or logged-in user is needed to trigger the vulnerable code path, such as opening or processing a crafted artifact. High attack complexity (AC:H) implies additional preconditions beyond simply being local - likely a specific system state, configuration, or timing requirement. The PR:N metric indicates no elevated credentials are needed to initiate the attack; a low-privileged local user could serve as the attacker. Scope is unchanged (S:U), confining the primary impact to the vulnerable endpoint itself rather than adjacent systems.

The CVSS 3.1 vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H establishes a meaningful set of exploitation constraints: local access is required, attack complexity is high, and user interaction must occur, collectively suppressing what would otherwise be a critical-rated vulnerability down to 7.0. No EPSS data is available in the provided input, and the vulnerability does not appear in CISA KEV, indicating no confirmed widespread exploitation. The absence of public proof-of-concept code further reduces near-term automated exploitation risk. Nonetheless, the full C:H/I:H/A:H impact triad - achievable through a CWE-78 injection into an agent running with elevated rights - means that successful exploitation yields complete host compromise. Enterprise security teams should prioritize patching this through their normal high-severity patch cycle, consulting TAN-2026-022 for the exact fixed version; the local-only attack vector limits remote exposure but does not eliminate risk in environments where endpoint access is shared or where social engineering is plausible.

A local user on an endpoint managed by Tanium Enforce crafts a malicious input - such as a specially formed file or parameter - that, when processed through a vulnerable code path triggered by user interaction, injects shell metacharacters into an unsanitized OS command call. If the high-complexity preconditions are met (specific system state or timing), the injected commands execute at the privilege level of the Enforce agent, typically SYSTEM or root in enterprise deployments. No public exploit code exists, and the AC:H requirement suggests reliable exploitation demands non-trivial effort or specific knowledge of the target environment.