The vulnerability, classified as CWE-1236, means that data generated by the Enforce service can be injected into web pages without proper escaping.

Based on the description, it is inferred that the vulnerability impacts Tanium Enforce across all deployed installations that have not applied the vendor‑provided fix. No specific version range is reported, so any instance of Enforce that has not been updated remains potentially vulnerable.

The CVSS score of 7.1 indicates a moderate‑to‑high severity assessment, but the description does not clarify whether authentication or network access is required. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting it may not be actively exploited. Based on the description, it is inferred that the flaw could be triggered by delivering unsanitized content to a victim’s browser through the Enforce web interface.