Quick answers
- Is CVE-2026-87084 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-87084 being exploited in the wild.
- How severe is CVE-2026-87084?
- High severity, with a CVSS score of 7.7, published 9 September 2026.
- Which products and versions are affected?
- Tanium Enforce 2.9 to 2.9.718 (2025H1), 2.10 to 2.10.760 (2025H2), 3.0 to 3.0.346 (2026H1).
- Is there a fix for CVE-2026-87084?
- A patch was published on 2026-09-09: Updates available for all affected releases Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-87084 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-87084?
- Check whether you run Tanium Enforce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a server-side request forgery (SSRF) in Tanium Enforce that can be exploited by authenticated users holding the enforce policy write permission. The flaw allows an attacker to make the Enforce server initiate requests to internal systems or endpoints, potentially reading data the attacker should not have access to. No user interaction is required beyond authentication, and the attack vector is over the network. The impact is confidentiality (high), with no impact on integrity or availability. Patches are available: Enforce v2.9.718+ (2025H1), v2.10.760+ (2025H2), and v3.0.346+ (2026H1).
Affected products
- Tanium Enforce 2.9 to 2.9.718 (2025H1), 2.10 to 2.10.760 (2025H2), 3.0 to 3.0.346 (2026H1)
Timeline
- 2026-09-09: disclosed
- 2026-09-09: patched: Updates available for all affected releases