Tanium Enforce EUVD-2026-116558

Exploitation requires an existing authenticated session with a low-privileged account on Tanium Enforce (PR:L), reachable over the network (AV:N) with low attack complexity and no user interaction. The concrete feature, endpoint, or configuration abused is not described in the available sources. The principal limiting factor is the authentication prerequisite: an attacker must already possess valid Enforce credentials or a foothold, so this is not remote-unauthenticated exploitation; impact is confined to integrity (no confidentiality or availability loss per the vector). No specific fixed version or mitigation detail was provided in the input beyond the existence of the Tanium advisory.

This is a moderate-priority issue rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw that requires an authenticated low-privileged account (PR:L), with impact limited to integrity (C:N/I:H/A:N) - consistent with CWE-863 improper authorization, where an already-authenticated user performs actions beyond their intended privilege level. The vuln.today Decision label is 'this_month' (not act_now or emergency), which aligns with a serious-but-not-urgent posture. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is present - only the Tanium vendor advisory. There is a signal conflict to flag: the input Tag 'Authentication Bypass' contradicts both the description ('improper access controls') and the assigned CWE-863 (Incorrect Authorization) as well as the PR:L metric, which requires valid authentication; this is an authorization/privilege flaw for authenticated users, not an authentication bypass - verify the intended class with Tanium. Overall, this is a real but bounded risk best handled on a planned patch cycle, prioritized above low-CVSS noise but below actively-exploited criticals.

An attacker who already holds a valid low-privileged Tanium Enforce account sends crafted requests to functionality they should not be authorized to use, leveraging the broken access control to alter data or configuration they should not be able to change (integrity impact). No user interaction or elevated privileges are needed, but a pre-existing authenticated foothold is required. No public exploit or PoC has been identified at time of analysis.