CVE-2026-87116 is a server-side request forgery (SSRF) vulnerability in Tanium Threat Response. It allows an attacker with low privileges to induce the server to send unauthorized requests, potentially exposing sensitive data. The vulnerability affects versions >=4.9 and <4.9.454, >=4.12 and <4.12.324, and >=4.17 and <4.17.292. The CVSS v3.1 base score is 6.5, with an attack vector of network, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality but not integrity or availability. No known exploits in the wild have been reported.

An attacker with low privileges can exploit this SSRF vulnerability to cause the server to make unauthorized network requests, potentially leading to the exposure of sensitive information. The impact is limited to confidentiality, with no direct impact on integrity or availability. No active exploitation has been reported.

The vulnerability has been addressed by Tanium in versions 4.9.454, 4.12.324, and 4.17.292 and later. Users should upgrade to these fixed versions to remediate the issue. Patch status is confirmed by the affected version ranges indicating fixed versions. No additional mitigation steps are specified in the vendor advisory data provided.