Tanium Enforce EUVD-2026-111264

Requires an authenticated session to Tanium Enforce (CVSS PR:L), so exploitation is limited to actors who already hold valid access to the Enforce component - it is not remote-unauthenticated. The specific feature, request, or configuration that triggers the uncontrolled resource consumption is not described in the available sources. Exploitation is further limited by impact scope: only availability is affected (A:L), with no confidentiality or integrity consequence, and only the Enforce component is in scope (S:U). Affected deployments are those running Enforce below the fixed builds 3.0.373, 2.9.736, or 2.10.778; patched instances are not exploitable. Updating to a fixed version is the remediation stated by the vendor.

This is a genuinely low-priority issue despite a NETWORK attack vector. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) scores 4.3 (MEDIUM) and the only impact is low availability (A:L) - no confidentiality or integrity loss. PR:L means an attacker must already be authenticated to the Enforce component, which substantially limits the exploit population to users who already have some legitimate access. There is no EPSS score, no CISA KEV listing, and no public PoC or exploit reference in the supplied data, so all three exploitation-likelihood signals are either absent or negative. The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', which is consistent with a modest, authenticated, availability-only defect. The signals are internally consistent - there is no conflict between a high CVSS and low real risk here, because the CVSS itself is only medium. The main caveat is mechanism: the description ('uncontrolled resource consumption', CWE-770) does not state how the resource exhaustion is triggered, so the exact request or operation that causes the DoS is not described in the available sources.

An authenticated user with access to Tanium Enforce sends requests or input that cause unbounded resource consumption (CWE-770), degrading or exhausting availability of the Enforce component. The specific trigger is not described in the available sources. No public exploit code or PoC reference was provided, and the impact is limited to availability (A:L), so this is a degradation-of-service scenario rather than remote code execution or data exposure.