EUVD-2026-116551
GHSA-fph4-qgp9-xhxg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged Enforce account
-
ExploitRequest resource lacking authorization check (CWE-862)
-
ImpactDisclose sensitive data (C:H)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated, low-privileged account on the Tanium Enforce module (CVSS PR:L); it is not a pre-authentication bypass despite the 'Authentication Bypass' tag. The impact is limited to unauthorized reading of data (C:H, I:N, A:N) - no modification or denial of service. The available description ('improper access controls vulnerability in Enforce') does not name the specific feature, endpoint, API, or configuration that must be reachable, so the exact trigger is not described in the available sources; defenders should consult Tanium advisory TAN-2026-099. The principal limiting factor is the need for valid Enforce credentials, which confines realistic risk to insiders or attackers who have already obtained a foothold account. |
| Impact | This is a moderate-priority issue, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity flaw that nonetheless requires an authenticated low-privileged account (PR:L) and yields only confidentiality impact (C:H/I:N/A:N) - i.e. unauthorized data disclosure, consistent with CWE-862 (missing authorization). The vuln.today decision label is 'this_month', which aligns with a 'fix in the normal patch cycle' posture rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no proof-of-concept are present in the supplied data, so there is no public exploitation signal: no public exploit identified at time of analysis. One conflict is worth flagging: the 'Authentication Bypass' tag implies no credentials are needed, but the CVSS vector (PR:L) and CWE-862 both indicate an authenticated user escalating their access to data, not a true pre-auth authentication bypass - treat the tag as imprecise and verify with the Tanium advisory. Net: a real but bounded confidentiality risk gated behind valid credentials, suitable for standard remediation prioritization. |
| Exploit ScenarioDerived | A low-privileged but authenticated Tanium Enforce user (or an attacker who has obtained such credentials) sends requests to a function or resource whose authorization checks are missing or incomplete, and reads sensitive data they should not be able to see. The attack is remote and low-complexity per CVSS, but the exact feature and request that trigger the flaw are not described in the available sources, and no proof-of-concept is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
An improper access control flaw (CWE-862) in Tanium's Enforce module allows a low-privileged authenticated user to read data they should not be authorized to access; the CVSS 3.1 score is 6.5 with C:H and no integrity or availability impact. The CVSS vector carries PR:L, so this is not a pre-authentication bypass despite the 'Authentication Bypass' tag - exploitation requires valid Enforce credentials, and no public exploit code or active exploitation is identified in the available data. Risk is confined to insiders or attackers who already hold a foothold account, making this a moderate-priority item rather than an emergency, with an EPSS-style urgency consistent with the 'this_month' decision label.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary step is to review Tanium advisory TAN-2026-099 (https://security.tanium.com/TAN-2026-099) for the fixed Enforce release and upgrade path, then apply that update across the affected Tanium Enforce deployment. Because exploitation requires a valid low-privileged Enforce account (CVSS PR:L) and the impact is read-only data exposure (C:H, I:N, A:N), the effective interim control is to restrict and review who holds Enforce accounts: audit accounts for least privilege, remove or disable unused and stale credentials, and limit network reachability to the Enforce interface to trusted administrative networks, accepting that this reduces but does not eliminate exposure from an already-authenticated insider. Monitor Enforce access and audit logs for reads of data outside a user's expected scope while the fix is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tanium Enforce is the policy-enforcement module of the Tanium endpoint management platform, used to define and apply configuration and compliance controls across managed endpoints. The root cause class is CWE-862 (Missing Authorization): an actor reaches a functionality path that does not verify the caller's privilege level, so authorization is effectively absent rather than merely misconfigured. Per the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the flaw is network-reachable, requires no user interaction, and yields high confidentiality impact with no modification or denial of service - a pure information-exposure consequence. The supplied description ('improper access controls vulnerability in Enforce') does not name the specific feature, endpoint, API, or configuration path that must be reachable, so the trigger is not described in the available sources; the CPE cpe:2.3:a:tanium:enforce:*:*:*:*:*:*:*:* indicates the affected product line without pinning a version from the available data. Defenders should consult Tanium advisory TAN-2026-099 for the precise component.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Authenticated low-privileged user (PR:L) remotely abuses a missing authorization check (CWE-862) to read data, so AV:N/AC:L/UI:N with confidentiality-only impact (C:H, I:N, A:N).
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an improper access controls vulnerability in Enforce.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB