# CVE-2026-116661: Tanium Enforce improper access controls

Source: https://junglewise.ai/threats/cve-2026-116661-tanium-addressed-an-improper-access-controls-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-116661 · Severity: medium · CVSS 6.5 · Published 2026-11-03

Tanium Enforce is an endpoint security policy management tool that controls what software and configurations are deployed to corporate devices. An authenticated user with policy write permissions could bypass access controls to move policies between content sets they should not have access to, potentially exposing sensitive security configurations or disrupting policy enforcement.

Technologies: [Tanium Enforce](https://junglewise.ai/threats/technologies/enforce). Vendors: [Tanium](https://junglewise.ai/threats/vendors/tanium).

## Quick answers

**Is CVE-2026-116661 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116661 being exploited in the wild.

**How severe is CVE-2026-116661?** Medium severity, with a CVSS score of 6.5, published 3 November 2026.

**Which products and versions are affected?** Tanium Enforce 2.10.0 to 2.10.778 (2025H2 Release); 3.0.0 to 3.0.373 (2026H1 Release).

**Is there a fix for CVE-2026-116661?** Yes: fixed in Enforce 2.10.778 (2025H2 Release Update 16), 3.0.373 (2026H1 Release Update 9). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116661 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-116661?** Check whether you run Tanium Enforce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Enforce 2.10.778 (2025H2 Release Update 16), 3.0.373 (2026H1 Release Update 9)

## Technical details

An improper access control vulnerability in Tanium Enforce allows an authenticated user with Enforce policy write permission and zero content sets to move policies between content sets without proper authorization checks. The vulnerability requires valid Tanium credentials and the specific "Enforce policy write" permission, but does not require elevated privileges. A successful exploit enables unauthorized policy manipulation.

## Affected products

- Tanium Enforce 2.10.0 to 2.10.778 (2025H2 Release); 3.0.0 to 3.0.373 (2026H1 Release)

## Timeline

- 2026-11-03: disclosed

## References

- [https://security.tanium.com/TAN-2026-096](https://security.tanium.com/TAN-2026-096)

## Related threats

- [Tanium multiple products improper certificate validation](https://junglewise.ai/threats/cve-2026-121565-tanium-addressed-an-improper-certificate-validation)
- [Tanium Enforce improper access control vulnerability](https://junglewise.ai/threats/cve-2026-116663-tanium-addressed-an-improper-access-controls-vulnerability-in)
- [Tanium Enforce compression bomb denial of service](https://junglewise.ai/threats/cve-2026-116662-tanium-addressed-a-compression-bomb-vulnerability-in-enforce)
- [Tanium Enforce improper access controls](https://junglewise.ai/threats/cve-2026-116660-tanium-addressed-an-improper-access-controls-vulnerability-in)
- [Tanium Enforce denial of service via resource consumption](https://junglewise.ai/threats/cve-2026-116659-tanium-addressed-an-uncontrolled-resource-consumption)