Tanium Threat Response CVE-2026-87116

Requires an authenticated principal with access to Tanium Threat Response (PR:L) - the attacker must already hold valid console/module credentials, so this is not exploitable by anonymous internet attackers. Exploitation depends on reaching a Threat Response feature that fetches attacker-influenced URLs; the vendor description does not name the specific feature, protocol, or configuration, and does not state whether a non-default mode is required. The main limiting factor is the authentication barrier; there is no user-interaction requirement (UI:N), and impact is confined to confidentiality (reading internal resources) with no integrity or availability effect and no scope change to other systems.

This is a moderate-risk, authenticated SSRF (CWE-918) in Tanium Threat Response, scored 6.5 by the vendor with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The signals are internally consistent for a network-reachable but privilege-gated issue: PR:L confirms the attacker needs valid authenticated access to the Tanium console/module, which meaningfully limits the population of potential attackers to insiders or actors who have already obtained credentials. The vendor asserts C:H with I:N/A:N, meaning the impact is pure confidentiality - the SSRF can be steered to read sensitive internal/cloud-metadata resources - but with no integrity or availability effect and no scope change (S:U). No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so there is no evidence of active exploitation or public exploit code; exploitation status is therefore 'no public exploit identified at time of analysis.' Net assessment: a real but not urgent priority - the authentication requirement and confidentiality-only impact keep it below the drop-everything threshold, though the C:H rating warrants prompt patching in environments where Threat Response holds or can reach sensitive internal services. One caveat: C:H for an SSRF is on the higher end and typically implies the vendor confirmed the response body (not just blind interaction) is returned to the attacker; the terse advisory does not spell this out, so verify the actual data-exposure depth with Tanium (TAN-2026-050).

An authenticated Tanium operator with access to Threat Response supplies an attacker-controlled URL to a feature that fetches remote content, causing the Tanium server to issue requests to internal-only hosts or the cloud instance-metadata endpoint and return that data to the attacker. Because the server acts as the request origin, the attacker can reach services otherwise firewalled from them and potentially harvest sensitive internal responses. No public POC or evidence of active exploitation was provided in the source data.