Live › vulnerability › CVE-2026-116649
Go to dashboardTanium Enforce can export CSV files containing attacker-injected data, including spreadsheet formulas (CSV injection, CWE-1236). An attacker with access to a system running the Tanium Client can plant the data. The formulas run when someone opens the export in a spreadsheet. Tanium rates it High (7.1) and lists no workaround.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 18:32 UTC. All times on this page are UTC.
Teams running Tanium Enforce on-prem or in Tanium Cloud, below the fixed update for their release train. The attacker needs access to an endpoint running the Tanium Client, and a user must open the exported CSV in a spreadsheet. Teams that never export CSVs from Enforce, or that already run a fixed update, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Tanium Enforce | vendor | >= 2.9, < 2.9.736; >= 2.10, < 2.10.778; >= 3.0, < 3.0.373 | 2.9.736, 2.10.778, 3.0.373 |
2.9.736 (2025H1), 2.10.778 (2025H2) or 3.0.373 (2026H1)Update Enforce to the fixed version for your release: 2025H1 Update 26 (v2.9.736), 2025H2 Update 16 (v2.10.778), 2026H1 Update 9 (v3.0.373), or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tanium addressed an improper output sanitization vulnerability in Enforce.
This page as .md · .json · in your agent: get_signal("CVE-2026-116649")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.