CVE-2026-116659: Tanium Enforce denial of service via resource consumption

CVE-2026-116659 · Severity: medium · CVSS 4.3 · Published 2026-10-27

Tanium Enforce is an endpoint security policy management tool used to control and protect corporate devices. An authenticated user with policy write permissions can trigger a denial of service attack that could disrupt the Enforce service's availability. The vulnerability requires valid credentials and appropriate permissions to exploit, limiting its impact to insider threats or compromised accounts.

Technologies: Tanium Enforce. Vendors: Tanium.

Quick answers

Is CVE-2026-116659 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116659 being exploited in the wild.
How severe is CVE-2026-116659?
Medium severity, with a CVSS score of 4.3, published 27 October 2026.
Which products and versions are affected?
Tanium Enforce 2.9 to 2.9.736 (2025H1), 2.10 to 2.10.778 (2025H2), 3.0 to 3.0.373 (2026H1).
Is there a fix for CVE-2026-116659?
Yes: fixed in Enforce 2.9.736 (2025H1 Update 26), 2.10.778 (2025H2 Update 16), 3.0.373 (2026H1 Update 9) and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116659 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-116659?
Check whether you run Tanium Enforce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Enforce 2.9.736 (2025H1 Update 26), 2.10.778 (2025H2 Update 16), 3.0.373 (2026H1 Update 9) and later

Technical details

An uncontrolled resource consumption vulnerability in Tanium Enforce allows an authenticated attacker with the Enforce Policy Write permission to conduct a denial of service attack through the Enforce application. The attack vector is network-based and requires authentication plus the specific Enforce Policy Write permission. A fix is available in updated versions across all affected release branches.

Affected products

  • Tanium Enforce 2.9 to 2.9.736 (2025H1), 2.10 to 2.10.778 (2025H2), 3.0 to 3.0.373 (2026H1)

Timeline

  • 2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.