# CVE-2026-116649: Tanium Enforce improper output sanitization

Source: https://junglewise.ai/threats/cve-2026-116649-tanium-addressed-an-improper-output-sanitization-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116649 · Severity: high · CVSS 7.1 · Published 2026-10-27

Tanium Enforce is an endpoint management and compliance tool that exports configuration data to CSV files. This vulnerability allows an attacker with access to a system running the Tanium Client to inject arbitrary formulas into CSV exports, which could execute malicious code when the CSV is opened in spreadsheet applications. An attacker could exploit this to achieve code execution or data exfiltration on systems that process these exported files.

Technologies: [Tanium Enforce](https://junglewise.ai/threats/technologies/enforce). Vendors: [Tanium](https://junglewise.ai/threats/vendors/tanium).

## Quick answers

**Is CVE-2026-116649 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116649 being exploited in the wild.

**How severe is CVE-2026-116649?** High severity, with a CVSS score of 7.1, published 27 October 2026.

**Which products and versions are affected?** Tanium Enforce 2025H1 Release prior to Update 26 (v2.9 to v2.9.736), 2025H2 Release prior to Update 16 (v2.10 to v2.10.778), 2026H1 Release prior to Update 9 (v3.0 to v3.0.373).

**Is there a fix for CVE-2026-116649?** Yes: fixed in Enforce 2025H1 Release Update 26 (v2.9.736) and later, 2025H2 Release Update 16 (v2.10.778) and later, 2026H1 Release Update 9 (v3.0.373) and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116649 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-116649?** Check whether you run Tanium Enforce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Enforce 2025H1 Release Update 26 (v2.9.736) and later, 2025H2 Release Update 16 (v2.10.778) and later, 2026H1 Release Update 9 (v3.0.373) and later

## Technical details

The vulnerability is an improper output sanitization flaw in Tanium Enforce's CSV export functionality. An attacker with access to a Tanium Client system can inject arbitrary data including formulas into CSV files exported by Enforce. The attack requires network access and user interaction (opening the malicious CSV in a spreadsheet application), and can result in code execution or information disclosure.

## Affected products

- Tanium Enforce 2025H1 Release prior to Update 26 (v2.9 to v2.9.736), 2025H2 Release prior to Update 16 (v2.10 to v2.10.778), 2026H1 Release prior to Update 9 (v3.0 to v3.0.373)

## Timeline

- 2026-10-27: advisory

## References

- [https://security.tanium.com/TAN-2026-072](https://security.tanium.com/TAN-2026-072)

## Related threats

- [Tanium multiple products improper certificate validation](https://junglewise.ai/threats/cve-2026-121565-tanium-addressed-an-improper-certificate-validation)
- [Tanium Enforce improper access control vulnerability](https://junglewise.ai/threats/cve-2026-116663-tanium-addressed-an-improper-access-controls-vulnerability-in)
- [Tanium Enforce improper access controls](https://junglewise.ai/threats/cve-2026-116661-tanium-addressed-an-improper-access-controls-vulnerability-in)
- [Tanium Enforce compression bomb denial of service](https://junglewise.ai/threats/cve-2026-116662-tanium-addressed-a-compression-bomb-vulnerability-in-enforce)
- [Tanium Enforce improper access controls](https://junglewise.ai/threats/cve-2026-116660-tanium-addressed-an-improper-access-controls-vulnerability-in)