CVE-2026-87084 is a server-side request forgery vulnerability in Tanium Enforce that affects versions 2.9, 2.10, and 3.0. The vulnerability allows an attacker with low privileges to induce the server to make unauthorized network requests, potentially exposing sensitive information. The CVSS 3.1 base score is 7.7, reflecting a high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and a confidentiality impact classified as high. The vendor has acknowledged the vulnerability but has not yet published an official fix or remediation guidance.

An attacker with low privileges can exploit this SSRF vulnerability to cause the Tanium Enforce server to make network requests to arbitrary locations, which can lead to unauthorized disclosure of sensitive information (high confidentiality impact). There is no impact on integrity or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor for updates from Tanium and apply patches promptly once available. Restricting network access from the Tanium Enforce server to only trusted destinations may help reduce exposure.