# CVE-2026-87088: Tanium Enforce local privilege escalation via malicious quarantine file

Source: https://junglewise.ai/threats/cve-2026-87088-tanium-enforce-local-privilege-escalation-via-malicious  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87088 · Severity: high · CVSS 7 · Published 2026-09-09

Tanium Enforce is an endpoint detection and response (EDR) solution used to protect corporate systems from threats. A vulnerability allows an attacker with local access to a system running the Tanium Client to escalate privileges to system level when a maliciously-named file in antivirus quarantine is processed during remediation actions. This could give attackers full control over protected systems.

Technologies: [Tanium Enforce](https://junglewise.ai/threats/technologies/enforce). Vendors: [Tanium](https://junglewise.ai/threats/vendors/tanium).

## Quick answers

**Is CVE-2026-87088 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87088 being exploited in the wild.

**How severe is CVE-2026-87088?** High severity, with a CVSS score of 7, published 9 September 2026.

**Which products and versions are affected?** Tanium Enforce 2.9 to 2.9.718 (2025H1), 2.10 to 2.10.760 (2025H2), 3.0 to 3.0.346 (2026H1).

**Is there a fix for CVE-2026-87088?** A patch was published on 2026-09-09: Patches available: v2.9.718 (2025H1 Update 24), v2.10.760 (2025H2 Update 14), v3.0.346 (2026H1 Update 7) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-87088 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-87088?** Check whether you run Tanium Enforce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A local privilege escalation vulnerability exists in Tanium Enforce's remediation action processing, triggered when handling maliciously-named files already present in antivirus quarantine. The vulnerability requires local access to a system with Tanium Client installed and user interaction (remediation action execution), but allows an authenticated or unprivileged attacker to achieve high-integrity code execution with system privileges. The vulnerability affects Enforce versions 2.9.x through 2.9.718, 2.10.x through 2.10.760, and 3.0.x through 3.0.346. Patches are available: Update 24 (v2.9.718) for 2025H1, Update 14 (v2.10.760) for 2025H2, and Update 7 (v3.0.346) for 2026H1.

## Affected products

- Tanium Enforce 2.9 to 2.9.718 (2025H1), 2.10 to 2.10.760 (2025H2), 3.0 to 3.0.346 (2026H1)

## Timeline

- 2026-09-09: disclosed
- 2026-09-09: patched: Patches available: v2.9.718 (2025H1 Update 24), v2.10.760 (2025H2 Update 14), v3.0.346 (2026H1 Update 7)

## References

- [https://security.tanium.com/TAN-2026-022](https://security.tanium.com/TAN-2026-022)

## Related threats

- [Tanium multiple products improper certificate validation](https://junglewise.ai/threats/cve-2026-121565-tanium-addressed-an-improper-certificate-validation)
- [Tanium Enforce improper access control vulnerability](https://junglewise.ai/threats/cve-2026-116663-tanium-addressed-an-improper-access-controls-vulnerability-in)
- [Tanium Enforce improper access controls](https://junglewise.ai/threats/cve-2026-116661-tanium-addressed-an-improper-access-controls-vulnerability-in)
- [Tanium Enforce compression bomb denial of service](https://junglewise.ai/threats/cve-2026-116662-tanium-addressed-a-compression-bomb-vulnerability-in-enforce)
- [Tanium Enforce improper access controls](https://junglewise.ai/threats/cve-2026-116660-tanium-addressed-an-improper-access-controls-vulnerability-in)