{"id":"CVE-2026-116649","kind":"vulnerability","aliases":["CVE-2026-116649"],"related":[],"title":"Tanium Enforce: improper output sanitization flaw, details unknown","description":"Tanium addressed an improper output sanitization vulnerability in Enforce.","summary":"Tanium Enforce can export CSV files containing attacker-injected data, including spreadsheet formulas (CSV injection, CWE-1236). An attacker with access to a system running the Tanium Client can plant the data. The formulas run when someone opens the export in a spreadsheet. Tanium rates it High (7.1) and lists no workaround.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Tanium Enforce","fixed":["2.9.736","2.10.778","3.0.373"],"affected":">= 2.9, < 2.9.736; >= 2.10, < 2.10.778; >= 3.0, < 3.0.373","ecosystem":"vendor"}],"ecosystems":[],"tags":["csv-injection","endpoint-management","enforce","self-hosted","tanium","tanium-cloud","vendor"],"not_affected_if":["fixed-version","no-csv-export"],"how_to_check":"Check the installed Enforce version in the Tanium Console (Enforce workbench / solution versions). You are exposed if it is below 2.9.736 (2025H1), 2.10.778 (2025H2) or 3.0.373 (2026H1). Tanium gives no command.","fix":"Update Enforce to the fixed version for your release: 2025H1 Update 26 (v2.9.736), 2025H2 Update 16 (v2.10.778), 2026H1 Update 9 (v3.0.373), or later.","status":"resolved","published_at":"2026-10-27T18:17:34+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","triaged_at":"2026-10-27T18:34:39+00:00","updated_at":"2026-10-27T18:35:47+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-27T18:34:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Tanium Enforce: improper output sanitization flaw, details unknown","impact":"medium","summary":"Tanium has fixed an output sanitization flaw in its Enforce product, as recorded by NVD. The sources do not say what an attacker can do with it.","category":"vendor","nicknames":[],"who_cares":["tanium","enforce"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the Tanium security advisory and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-116649) for affected versions, the fixed version, and the required access.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000485,"input_tokens":3230,"output_tokens":323,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Tanium security advisory and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-116649) for affected versions, the fixed version, and the required access.","search":"'-116649':11A,14A '-1236':49B '-2026':10A,13A '7.1':80B 'access':53B 'address':86C 'attack':40B,51B 'attacker-inject':39B 'client':60B 'cloud':30B 'contain':38B 'csv':18B,36B,46B 'csv-inject':17B 'cve':9A,12A 'cwe':48B 'data':42B,64B 'detail':7A 'endpoint':21B 'endpoint-manag':20B 'enforc':2A,23B,33B,93C 'enforce':16A 'export':35B,72B 'file':37B 'flaw':6A 'formula':45B,66B 'high':79B 'host':26B 'improp':3A,88C 'includ':43B 'inject':19B,41B,47B 'list':82B 'manag':22B 'open':70B 'output':4A,89C 'plant':62B 'rate':77B 'run':57B,67B 'sanit':5A,90C 'self':25B 'self-host':24B 'someon':69B 'spreadsheet':44B,75B 'system':56B 'tanium':1A,15A,27B,29B,32B,59B,76B,85C 'tanium-cloud':28B 'unknown':8A 'vendor':31B 'vulner':91C 'workaround':84B","nicknames":[],"mitigations":[],"who_affected":"Teams running Tanium Enforce on-prem or in Tanium Cloud, below the fixed update for their release train. The attacker needs access to an endpoint running the Tanium Client, and a user must open the exported CSV in a spreadsheet. Teams that never export CSVs from Enforce, or that already run a fixed update, can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-27T18:35:47Z","by":"analyst","run_id":913},"products":{"at":"2026-10-27T18:35:47Z","by":"analyst","run_id":913},"mitigations":{"at":"2026-10-27T18:35:47Z","by":"analyst","run_id":913},"workarounds":{"at":"2026-10-27T18:35:47Z","by":"analyst","run_id":913},"who_affected":{"at":"2026-10-27T18:35:47Z","by":"analyst","run_id":913}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"3938794e-25f5-4123-a1ba-5cbd7f104512","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116649","severity":null,"published_at":"2026-10-27T18:17:34+00:00","modified_at":"2026-10-27T18:17:34+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","fetched_at":"2026-10-27T18:32:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116649:913","url":null,"severity":null,"published_at":"2026-10-27T18:35:47+00:00","modified_at":"2026-10-27T18:35:47+00:00","first_seen_at":"2026-10-27T18:35:47+00:00","fetched_at":"2026-10-27T18:35:47+00:00","note":"Read Tanium TAN-2026-072 (vendor advisory) and CNA record: CSV/formula injection (CWE-1236) in Enforce exports; fixed in Update 26/16/9. No exploitation or PoC found; no public discussion searched."}],"documents":[{"id":7379,"url":"https://security.tanium.com/TAN-2026-072","title":"TAN-2026-072 Tanium Enforce","kind":"advisory","source":"analyst","text":"Tanium addressed an improper output sanitization vulnerability in Enforce. High 7.1. Attacker with access to a system running the Tanium Client can inject arbitrary data, including formulas, in CSV files exported by Enforce. Affected: 2025H1 Enforce prior to Update 26 (v2.9.736); 2025H2 prior to Update 16 (v2.10.778); 2026H1 prior to Update 9 (v3.0.373). Fixed in those. Workaround: None.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":7380,"url":"https://cve.circl.lu/api/vulnerability/CVE-2026-116649","title":"CVE record CVE-2026-116649 (CWE-1236)","kind":"other","source":"analyst","text":"CNA record by Tanium: Enforce 2.9 <2.9.736, 2.10 <2.10.778, 3.0 <3.0.373. CWE-1236 Improper Neutralization of Formula Elements in a CSV File. CVSS 7.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Reference TAN-2026-072.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}