---
id: "CVE-2026-116649"
kind: "vulnerability"
aliases: ["CVE-2026-116649"]
title: "Tanium Enforce: improper output sanitization flaw, details unknown"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "resolved"
category: "vendor"
products: [{"name": "Tanium Enforce", "fixed": ["2.9.736", "2.10.778", "3.0.373"], "affected": ">= 2.9, < 2.9.736; >= 2.10, < 2.10.778; >= 3.0, < 3.0.373", "ecosystem": "vendor"}]
ecosystems: []
tags: ["csv-injection", "endpoint-management", "enforce", "self-hosted", "tanium", "tanium-cloud", "vendor"]
not_affected_if: ["fixed-version", "no-csv-export"]
published_at: "2026-10-27T18:17:34+00:00"
first_seen_at: "2026-10-27T18:32:59+00:00"
updated_at: "2026-10-27T18:35:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116649", "first_seen_at": "2026-10-27T18:32:59+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T18:35:47+00:00"}]
---

# Tanium Enforce: improper output sanitization flaw, details unknown

Tanium Enforce can export CSV files containing attacker-injected data, including spreadsheet formulas (CSV injection, CWE-1236). An attacker with access to a system running the Tanium Client can plant the data. The formulas run when someone opens the export in a spreadsheet. Tanium rates it High (7.1) and lists no workaround.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Tanium Enforce affected >= 2.9, < 2.9.736; >= 2.10, < 2.10.778; >= 3.0, < 3.0.373 fixed 2.9.736, 2.10.778, 3.0.373

## How to check

Check the installed Enforce version in the Tanium Console (Enforce workbench / solution versions). You are exposed if it is below 2.9.736 (2025H1), 2.10.778 (2025H2) or 3.0.373 (2026H1). Tanium gives no command.

## Fix

Update Enforce to the fixed version for your release: 2025H1 Update 26 (v2.9.736), 2025H2 Update 16 (v2.10.778), 2026H1 Update 9 (v3.0.373), or later.

## Timeline

- 2026-10-27T18:32:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116649
- 2026-10-27T18:35:47+00:00 analyst — Read Tanium TAN-2026-072 (vendor advisory) and CNA record: CSV/formula injection (CWE-1236) in Enforce exports; fixed in Update 26/16/9. No exploitation or PoC found; no public discussion searched.

## Documents

- [advisory] TAN-2026-072 Tanium Enforce https://security.tanium.com/TAN-2026-072
- [describes] CVE record CVE-2026-116649 (CWE-1236) https://cve.circl.lu/api/vulnerability/CVE-2026-116649

## From the sources

Tanium addressed an improper output sanitization vulnerability in Enforce.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_