EUVD-2026-111251
GHSA-q9gm-q5gv-9rgw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege Enforce account
-
ExploitRequest resource lacking authorization check
-
ImpactAccess unauthorized low-sensitivity data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on Tanium Enforce (PR:L), reachable over the network with no user interaction. Exploitation is limited to accounts that can already log in; it is not remote-unauthenticated. The specific product feature, endpoint, or configuration that lacks the authorization check is not described in the available sources, so the precise trigger cannot be stated. Affected deployments are Enforce 2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373; updating to or beyond these fixed builds removes exposure. The low privilege requirement and the single limited-confidentiality impact (no integrity or availability effect) constrain realistic risk. |
| Impact | This is a moderate-severity, lower-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable flaw that is low-complexity but requires an already-authenticated account (PR:L) and yields only limited confidentiality impact with no integrity or availability effect - consistent with the CWE-862 (Missing Authorization) classification. There is no KEV listing, no EPSS score in the input, and no public exploit or PoC reference among the supplied references, so exploitation is not demonstrated. The vuln.today priority is 'this_month', which aligns with the modest CVSS and the absence of active-exploitation signals: it warrants scheduled patching, not an incident response. One signal conflict worth noting: the 'Authentication Bypass' tag contradicts both the CWE-862 (missing authorization, not authentication) and the PR:L metric (authentication is required, not bypassed) - treat this as an access-control/privilege issue, not an auth bypass. Severity is capped by the single low confidentiality impact and the authentication requirement. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account on a Tanium Enforce instance sends requests to a function or resource that fails to enforce proper authorization, reading data they should not be permitted to see (C:L). No public exploit or PoC is identified, and no user interaction is required; the specific feature or endpoint affected is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Improper access controls in Tanium Enforce allow authenticated users with low privileges to read limited data they should not be able to access, with no integrity or availability impact. Enforce 2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373 are affected; CVSS 3.1 scores this 4.3 as a network-reachable, low-privilege issue requiring a valid session. No public exploit code was identified at time of analysis, and the vendor has released fixed builds.
RemediationAI
Vendor-released patch: update Tanium Enforce to 2.9.736, 2.10.778, or 3.0.373, respectively, for each affected branch; updating to or beyond these fixed builds removes exposure. The authoritative remediation details are in the Tanium advisory at https://security.tanium.com/TAN-2026-079. No additional workaround is described in the available sources, and the vendor identifies the fixed builds as the complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tanium Enforce is a Tanium product identified in the CPE data as cpe:2.3:a:tanium:enforce. The flaw is classified as CWE-862 (Missing Authorization), meaning a reachable function or endpoint does not verify that the authenticated caller holds the permission required for the requested operation. The CVSS vector shows network reachability, low privileges, no user interaction, and a single low-confidentiality impact. The advisory does not name the specific feature, endpoint, or configuration that lacks the authorization check, so the precise trigger cannot be stated from the available sources.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable but needs an authenticated account (PR:L), CWE-862 missing authorization with low-complexity access to limited data, so C:L and I:N/A:N.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an improper access controls vulnerability in Enforce.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB