CVE-2026-87084 Overview
CVE-2026-87084 is a server-side request forgery (SSRF) vulnerability in Tanium Enforce. The flaw allows an authenticated attacker with low privileges to coerce the Enforce server into issuing arbitrary outbound network requests. Because the vulnerability crosses a security boundary (scope change), successful exploitation can expose internal services and resources that are not otherwise reachable from the network.
The issue is tracked under CWE-918: Server-Side Request Forgery and documented in Tanium Security Advisory TAN-2026-036.
Critical Impact
Authenticated attackers can pivot from the Enforce server to internal-only endpoints, cloud metadata services, and adjacent systems, exposing sensitive data without requiring user interaction.
Affected Products
- Tanium Enforce (refer to vendor advisory for affected versions)
- Tanium platform deployments running the Enforce module
- On-premises and Tanium-hosted Enforce instances
Discovery Timeline
- 2026-09-09 - CVE CVE-2026-87084 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87084
Vulnerability Analysis
The vulnerability resides in Tanium Enforce, a module used to manage endpoint configuration and policy enforcement. Enforce accepts a user-controlled input that is subsequently used to construct a server-side HTTP request. Because the destination is not sufficiently validated against an allowlist, an authenticated user can direct the server to make requests to arbitrary hosts and ports.
The scope change in the vulnerability profile indicates that successful exploitation grants access to resources beyond the vulnerable component's own security context. In practical SSRF terms, this typically means reaching internal management interfaces, cloud instance metadata services, or lateral services that trust the Enforce server's network position.
Exploitation requires network access to the Enforce interface and valid low-privilege credentials. No user interaction is needed, and the attack complexity is low. The impact is confined to confidentiality; integrity and availability are not directly affected by this specific weakness.
Root Cause
The root cause is insufficient validation of URLs or hostnames supplied to a server-side fetching function within Enforce. The application does not enforce a strict allowlist of destination hosts, nor does it block requests to private IP ranges, loopback addresses, or link-local metadata endpoints such as 169.254.169.254.
Attack Vector
An authenticated user submits a crafted request to an Enforce endpoint that accepts a URL or hostname parameter. The Enforce server issues the outbound request on the attacker's behalf and returns response data or observable side effects. Attackers use this primitive to enumerate internal services, retrieve cloud credentials from metadata endpoints, or interact with unauthenticated administrative APIs on adjacent systems.
No verified exploit code is publicly available. See Tanium Security Advisory TAN-2026-036 for vendor-supplied technical detail.
Detection Methods for CVE-2026-87084
Indicators of Compromise
- Outbound HTTP requests from the Tanium Enforce server to internal RFC1918 ranges, loopback, or link-local addresses such as 169.254.169.254.
- Unusual DNS lookups originating from the Enforce host targeting internal-only hostnames.
- Enforce application logs showing user-supplied URL parameters pointing to non-standard destinations.
Detection Strategies
- Inspect Enforce audit logs for API calls containing URL or hostname parameters that resolve to internal, loopback, or cloud metadata addresses.
- Correlate low-privilege user sessions with anomalous outbound traffic from the Enforce server using network flow telemetry.
- Baseline normal outbound destinations from Enforce and alert on deviations, particularly to ports associated with administrative services.
Monitoring Recommendations
- Forward Tanium application and web server logs to a centralized analytics platform for retention and query.
- Enable egress filtering telemetry on the Enforce host and alert on connections to metadata IPs and internal management subnets.
- Track authentication events for Enforce accounts with API access and flag credential reuse from unexpected source addresses.
How to Mitigate CVE-2026-87084
Immediate Actions Required
- Apply the fixed Enforce version documented in Tanium Security Advisory TAN-2026-036 as soon as the update is available in your environment.
- Audit Enforce user accounts and revoke API access for accounts that do not require it.
- Rotate any credentials that may have been reachable from the Enforce server, including cloud instance credentials if Enforce runs in a cloud environment.
Patch Information
Tanium has addressed the SSRF vulnerability in Enforce. Refer to Tanium Security Advisory TAN-2026-036 for the specific fixed versions and upgrade guidance applicable to your deployment.
Workarounds
- Restrict outbound network access from the Enforce server using host or network firewalls, denying traffic to internal management subnets and cloud metadata endpoints.
- Require IMDSv2 on AWS-hosted Enforce instances to reduce the risk of metadata credential exfiltration via SSRF.
- Limit Enforce console and API access to trusted administrative networks through network segmentation and access control lists.
# Example: block Enforce host access to AWS instance metadata
iptables -A OUTPUT -m owner --uid-owner tanium \
-d 169.254.169.254 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
