Tanium Enforce: compression bomb flaw; sources give no fix details

1. NVD2026-10-27 18:32 UTC · published 2026-10-27 18:17 UTC · CVE-2026-116662
2. InfraStack analyst2026-10-27 18:36 UTC · published 2026-10-27 18:36 UTC
   “Could not find a Tanium advisory for an Enforce compression bomb. Tanium's compression-bomb advisories cover Findings (TAN-2026-020, CVE-2026-11617) and Threat Response (TAN-2026-021, CVE-2026-75476), both Low 3.1 DoS-only. I checked TAN-2026-020 to 047 and the only Enforce advisories are 022 (local privilege escalation) and 036 (SSRF), neither a compression bomb. The NVD page for this id returned nothing, and this id looks like a possible typo or mix-up with those CVEs. Enforce fixed builds that other Oct 27 advisories use: v2.9.718, v2.10.760, v3.0.346, but they are NOT confirmed for this CVE. Nothing verified. To settle it, read the NVD/CVE record for CVE-2026-116662 or the Tanium advisory index (security.tanium.com), whose titles do not render.”

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• NVD: CVE-2026-116662 · 10-27 18:32

This page as .md · .json · in your agent: get_signal("CVE-2026-116662")

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.