Tanium Enforce EUVD-2026-111266

The description states only that the flaw is an uncontrolled resource consumption issue in Tanium Enforce; it does not name the specific feature, protocol, request type, or configuration that triggers it, so the exact precondition is not described in the available sources. The CVSS vector indicates no special configuration, privileges, or user interaction (AC:L/PR:N/UI:N) and network reachability (AV:N), implying exploitation against a reachable Enforce instance; however, because Enforce is an endpoint-management console typically deployed inside a managed enterprise perimeter, practical exposure is limited by network reachability of the service, and the unauthenticated nature should be confirmed against the vendor advisory. Impact is limited to availability only (C:N/I:N) - no data disclosure or modification. Remediation requires upgrading to Enforce 2.9.736, 2.10.778, or 3.0.373 or later per the affected branch.

This is a CWE-400 uncontrolled resource consumption flaw in Tanium Enforce scored CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - a network-reachable, low-complexity condition requiring no privileges or user interaction, with impact confined entirely to availability (C:N/I:N). The 7.5 score is driven solely by the denial-of-service impact; there is no confidentiality or integrity exposure, so this is a service-disruption risk rather than a compromise risk. No EPSS score, KEV listing, or POC reference was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world urgency therefore rests on the vendor's own priority signal rather than observed attacker activity. The vuln.today decision label is 'this_week,' indicating a prompt-but-not-emergency remediation posture, which is consistent with a no-auth network DoS that lacks any exploitation evidence. One caveat: the CVSS vector asserts PR:N (unauthenticated), but the description gives no detail on whether reaching the vulnerable Enforce function requires an authenticated session typical of an endpoint-management console - this should be verified with the vendor advisory (TAN-2026-071). EPSS being absent (not low) means exploitation probability is simply unquantified here, not that it is negligible.

A remote attacker sends specially crafted or high-volume requests to the network-exposed Tanium Enforce service, triggering uncontrolled consumption of a resource (CPU, memory, or similar) and exhausting it. This degrades or crashes the Enforce service, denying availability to legitimate endpoint-policy operations. No public exploit code was identified in the provided data, and the exact trigger is not described in the available sources.