Enforce
Monthly
Uncontrolled resource consumption in Tanium Enforce allows remote attackers to degrade or exhaust service availability across the 2.9, 2.10, and 3.0 branches, rated CVSS 7.5 with availability-only impact (C:N/I:N/A:H). The assessed vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity attack requiring no privileges or user interaction, though the vendor description does not name the specific feature, protocol, or request type that triggers the exhaustion, and practical exposure is bounded by network reachability of an endpoint-management console normally deployed inside a managed enterprise perimeter. Vendor patches are available in Enforce 2.9.736, 2.10.778, and 3.0.373; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or KEV data was supplied.
Improper output sanitization in Tanium Enforce 2.9, 2.10, and 3.0 allows a network-reachable attacker to craft malicious output that can lead to limited information disclosure and integrity impact when a legitimate user views or exports affected data (CVSS 7.1). The CVSS vector indicates no required privileges (PR:N) but user interaction (UI:R) is required, and whether injecting the payload itself requires prior authenticated access to Enforce is unverified; no public exploit identified at time of analysis. Tanium has released fixed builds in Enforce 2.9.736, 2.10.778, and 3.0.373, and the vuln.today priority engine rates remediation as 'this_week'.
Denial of service in Tanium Enforce (3.0 before 3.0.373, 2.10 before 2.10.778, and 2.9 before 2.9.736) lets remote attackers consume resources by getting a highly compressed payload into a decompression path, a compression bomb (CWE-409) carrying an availability-only impact and a 7.5 severity score. Fixed builds are published by the vendor, and no public exploit code has been identified at time of analysis. The precise feature or input that performs the decompression is not described in the available sources, so the practical precondition remains the affected version plus the ability to deliver a crafted payload to that path.
Server-side request forgery in Tanium Enforce allows authenticated low-privileged users to cause the Enforce server to issue arbitrary HTTP requests to internal network resources outside the application's normal authorization boundary. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect that a successful attack can expose internal services, cloud metadata endpoints, or backend infrastructure inaccessible to the attacker directly. Tanium disclosed and addressed this issue in advisory TAN-2026-036; no public exploit code or active exploitation has been identified at time of analysis.
OS command injection in Tanium Enforce enables a local attacker to execute arbitrary operating system commands at the privilege level of the Enforce agent process. The flaw (CWE-78) requires user interaction and specific exploitation preconditions, reflected in a CVSS 7.0 score despite full C:H/I:H/A:H impact ratings. Tanium self-disclosed the issue via advisory TAN-2026-022; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Improper access controls in Tanium Enforce allow a remote attacker with an existing low-privileged authenticated session to modify protected data without user interaction, producing high integrity impact while confidentiality and availability remain unaffected. The issue is tracked as CVE-2026-116661 (CWE-863), affects Tanium Enforce per the supplied CPE, and the specific feature or endpoint abused is not described in the available sources. No public exploit identified at time of analysis and no CISA KEV entry is present; Tanium's advisory is TAN-2026-096.
An improper access control flaw (CWE-862) in Tanium's Enforce module allows a low-privileged authenticated user to read data they should not be authorized to access; the CVSS 3.1 score is 6.5 with C:H and no integrity or availability impact. The CVSS vector carries PR:L, so this is not a pre-authentication bypass despite the 'Authentication Bypass' tag - exploitation requires valid Enforce credentials, and no public exploit code or active exploitation is identified in the available data. Risk is confined to insiders or attackers who already hold a foothold account, making this a moderate-priority item rather than an emergency, with an EPSS-style urgency consistent with the 'this_month' decision label.
An uncontrolled resource consumption flaw (CWE-770) in Tanium Enforce lets an authenticated user drive the Enforce component into resource exhaustion, degrading only the availability of that component. Deployments running Enforce 3.0 before 3.0.373, 2.9 before 2.9.736, or 2.10 before 2.10.778 are affected; patched builds are not exploitable. The CVSS score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), reflecting a low-impact, availability-only issue that requires a valid Enforce session - no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Denial of service in Tanium Enforce allows an authenticated low-privileged user with network reachability to the Enforce component to crash the service through a null pointer dereference (CWE-476), rated CVSS 6.5 with availability impact High and no confidentiality or integrity effect. Affected deployments are Enforce 2.9 before 2.9.736, Enforce 2.10 before 2.10.778, and Enforce 3.0 before 3.0.373, and the vendor (Tanium, TAN-2026-074) has released fixed builds for each branch. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation is confined to users who already hold valid credentials on the Tanium platform.
Improper access controls in Tanium Enforce allow authenticated users with low privileges to read limited data they should not be able to access, with no integrity or availability impact. Enforce 2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373 are affected; CVSS 3.1 scores this 4.3 as a network-reachable, low-privilege issue requiring a valid session. No public exploit code was identified at time of analysis, and the vendor has released fixed builds.
Denial of service in Tanium Enforce (2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373) lets unauthenticated remote attackers degrade the Enforce service by consuming a resource that is not bounded or throttled (CWE-770). The CVSS 3.1 score of 5.3 reflects network reachability with low attack complexity and no privileges or user interaction, but impact is confined to low availability with no confidentiality or integrity effect, so successful abuse causes partial service degradation rather than system compromise or full outage. No public exploit code was identified at time of analysis and no CISA KEV entry exists; Tanium has released fixed builds and the advisory is TAN-2026-052.
Tanium addressed an incorrect default permissions vulnerability in Enforce. [CVSS 6.5 MEDIUM]
Tanium addressed an improper link resolution before file access vulnerability in Enforce. [CVSS 5.0 MEDIUM]
Uncontrolled resource consumption in Tanium Enforce allows remote attackers to degrade or exhaust service availability across the 2.9, 2.10, and 3.0 branches, rated CVSS 7.5 with availability-only impact (C:N/I:N/A:H). The assessed vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity attack requiring no privileges or user interaction, though the vendor description does not name the specific feature, protocol, or request type that triggers the exhaustion, and practical exposure is bounded by network reachability of an endpoint-management console normally deployed inside a managed enterprise perimeter. Vendor patches are available in Enforce 2.9.736, 2.10.778, and 3.0.373; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or KEV data was supplied.
Improper output sanitization in Tanium Enforce 2.9, 2.10, and 3.0 allows a network-reachable attacker to craft malicious output that can lead to limited information disclosure and integrity impact when a legitimate user views or exports affected data (CVSS 7.1). The CVSS vector indicates no required privileges (PR:N) but user interaction (UI:R) is required, and whether injecting the payload itself requires prior authenticated access to Enforce is unverified; no public exploit identified at time of analysis. Tanium has released fixed builds in Enforce 2.9.736, 2.10.778, and 3.0.373, and the vuln.today priority engine rates remediation as 'this_week'.
Denial of service in Tanium Enforce (3.0 before 3.0.373, 2.10 before 2.10.778, and 2.9 before 2.9.736) lets remote attackers consume resources by getting a highly compressed payload into a decompression path, a compression bomb (CWE-409) carrying an availability-only impact and a 7.5 severity score. Fixed builds are published by the vendor, and no public exploit code has been identified at time of analysis. The precise feature or input that performs the decompression is not described in the available sources, so the practical precondition remains the affected version plus the ability to deliver a crafted payload to that path.
Server-side request forgery in Tanium Enforce allows authenticated low-privileged users to cause the Enforce server to issue arbitrary HTTP requests to internal network resources outside the application's normal authorization boundary. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect that a successful attack can expose internal services, cloud metadata endpoints, or backend infrastructure inaccessible to the attacker directly. Tanium disclosed and addressed this issue in advisory TAN-2026-036; no public exploit code or active exploitation has been identified at time of analysis.
OS command injection in Tanium Enforce enables a local attacker to execute arbitrary operating system commands at the privilege level of the Enforce agent process. The flaw (CWE-78) requires user interaction and specific exploitation preconditions, reflected in a CVSS 7.0 score despite full C:H/I:H/A:H impact ratings. Tanium self-disclosed the issue via advisory TAN-2026-022; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Improper access controls in Tanium Enforce allow a remote attacker with an existing low-privileged authenticated session to modify protected data without user interaction, producing high integrity impact while confidentiality and availability remain unaffected. The issue is tracked as CVE-2026-116661 (CWE-863), affects Tanium Enforce per the supplied CPE, and the specific feature or endpoint abused is not described in the available sources. No public exploit identified at time of analysis and no CISA KEV entry is present; Tanium's advisory is TAN-2026-096.
An improper access control flaw (CWE-862) in Tanium's Enforce module allows a low-privileged authenticated user to read data they should not be authorized to access; the CVSS 3.1 score is 6.5 with C:H and no integrity or availability impact. The CVSS vector carries PR:L, so this is not a pre-authentication bypass despite the 'Authentication Bypass' tag - exploitation requires valid Enforce credentials, and no public exploit code or active exploitation is identified in the available data. Risk is confined to insiders or attackers who already hold a foothold account, making this a moderate-priority item rather than an emergency, with an EPSS-style urgency consistent with the 'this_month' decision label.
An uncontrolled resource consumption flaw (CWE-770) in Tanium Enforce lets an authenticated user drive the Enforce component into resource exhaustion, degrading only the availability of that component. Deployments running Enforce 3.0 before 3.0.373, 2.9 before 2.9.736, or 2.10 before 2.10.778 are affected; patched builds are not exploitable. The CVSS score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), reflecting a low-impact, availability-only issue that requires a valid Enforce session - no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Denial of service in Tanium Enforce allows an authenticated low-privileged user with network reachability to the Enforce component to crash the service through a null pointer dereference (CWE-476), rated CVSS 6.5 with availability impact High and no confidentiality or integrity effect. Affected deployments are Enforce 2.9 before 2.9.736, Enforce 2.10 before 2.10.778, and Enforce 3.0 before 3.0.373, and the vendor (Tanium, TAN-2026-074) has released fixed builds for each branch. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation is confined to users who already hold valid credentials on the Tanium platform.
Improper access controls in Tanium Enforce allow authenticated users with low privileges to read limited data they should not be able to access, with no integrity or availability impact. Enforce 2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373 are affected; CVSS 3.1 scores this 4.3 as a network-reachable, low-privilege issue requiring a valid session. No public exploit code was identified at time of analysis, and the vendor has released fixed builds.
Denial of service in Tanium Enforce (2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373) lets unauthenticated remote attackers degrade the Enforce service by consuming a resource that is not bounded or throttled (CWE-770). The CVSS 3.1 score of 5.3 reflects network reachability with low attack complexity and no privileges or user interaction, but impact is confined to low availability with no confidentiality or integrity effect, so successful abuse causes partial service degradation rather than system compromise or full outage. No public exploit code was identified at time of analysis and no CISA KEV entry exists; Tanium has released fixed builds and the advisory is TAN-2026-052.
Tanium addressed an incorrect default permissions vulnerability in Enforce. [CVSS 6.5 MEDIUM]
Tanium addressed an improper link resolution before file access vulnerability in Enforce. [CVSS 5.0 MEDIUM]