CVE-2026-87019

Executive Summary

CVE-2026-87019 is an improper access control vulnerability (CWE-639, Authorization Bypass Through User-Controlled Key) in Tanium Comply, Tanium's endpoint compliance-assessment and vulnerability-scanning module. The flaw is network-reachable and requires only a low-privileged, authenticated foothold, but its impact is bounded: CVSS 3.1 rates it 4.3 with Integrity:Low and no Confidentiality or Availability impact, meaning an attacker with a legitimate low-privilege account can make unauthorized modifications to resources they should not own. No public exploit, Nuclei template, or exploit code exists as of this report, and EPSS is 0.00152 (4.7th percentile), indicating no observed exploitation activity.

Technical Analysis

CWE-639 describes authorization bypass through a user-controlled key — a class of flaw in which an application accepts a client-supplied identifier (an object ID, tenant ID, record key, or similar reference) and acts on the referenced resource without verifying that the requesting principal is authorized to operate on it. This is the horizontal/vertical privilege-escalation family commonly summarized as IDOR (Insecure Direct Object Reference) where the manipulated key drives a write operation rather than a read.

Mapping the flaw class to the CVSS vector is the most reliable way to characterize the mechanism, given the sparse vendor description. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N tells us several concrete and defensible things:

• AV:N (Network): The vulnerable interface is reachable over the network; no adjacent-only or local-only constraint is asserted. Tanium Comply is consumed by endpoint agents and by the Tanium console/web client, all of which communicate over network transports.
• AC:L (Low): No race condition, no exotic preconditions, no special environment is required. The attack succeeds deterministically once the correct key value is supplied.
• PR:L (Low): A valid, authenticated account is required — this is an authenticated authorization flaw, not a pre-authentication bypass. The attacker must already hold credentials for some low-privileged role in the environment.
• UI:N (None): No victim interaction is needed; the attacker drives the request directly.
• S:U (Unchanged): The exploited component's authorization scope is not asserted to cross a security boundary (e.g., hypervisor/container/OS). The damage is contained to the vulnerable application's own authorization domain.
• C:N / I:L / A:N: The attacker cannot read data they shouldn't, can make limited unauthorized modifications, and cannot degrade availability. The "Low" integrity rating typically reflects modification of application state, configuration, or assessment metadata rather than wholesale destruction of records.

Because CWE-639 centers on a user-controlled key, the attack surface is any Comply request path where a client supplies an object reference that is then used in a state-changing operation without an ownership/permission check. In a compliance-scanning product, the resource classes that plausibly carry such references are scan definitions, scan results, compliance policy assignments, endpoint/asset group memberships, and exemption or exception records. The NVD description provides no function names, endpoints, parameters, or file paths, so no specific implementation detail can be asserted. What can be stated at the vulnerability-class level is that the server trusts the caller's supplied key and omits the authorization check that binds that key to the caller's identity and role.

A second structural point: even where the product enforces role-based access control at the UI layer, CWE-639 classically manifests when the backend trusts a key passed through an API, background job, or agent channel that the UI would otherwise constrain. That is consistent with Integrity:Low — the attacker is not reading protected compliance data (C:N) but is altering records or settings they ought not to touch (I:L).

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-87019. The following chain is inferred from the vulnerability class (CWE-639) and the CVSS vector only and does not assert undocumented implementation specifics.

1. Reconnaissance / target identification: Identify a reachable Tanium Comply deployment. Tanium infrastructure is typically internal-only, but hybrid and internet-facing management planes exist and are frequently indexed by Shodan using the dorks listed in the metadata. Determine the version in use and whether a low-privileged account can be obtained (help-desk role, read-only operator, contractor account, or any compromised endpoint account with limited console rights).

2. Triggering the flaw class: Authenticate with the low-privileged account (PR:L) and issue network requests to Comply operations that accept a client-supplied resource key. The attacker substitutes the identifier of an object belonging to another user, another user group, or a higher-privileged scope. Because the server fails to verify that the caller is authorized to act on that key (CWE-639), the request is processed against the substituted target — a horizontal or vertical authorization bypass for a write operation.

3. Payload / execution at the vulnerability-class level: The "payload" is the manipulated key itself, not shellcode or a script. The request is an ordinary authenticated call with a modified identifier field. AC:L and UI:N mean no timing tricks, coercion, or victim action are required — the attacker simply replays the operation with a different key value.

4. Post-exploitation impact: The attacker achieves limited unauthorized modification (I:L) within Comply's own domain (S:U). Depending on what object class the key addresses, plausible outcomes include tampering with scan definitions, policy assignments, exemption/exception records, or compliance assessment metadata — potentially causing endpoint compliance results to be suppressed, altered, or misattributed. Confidentiality is not impacted (C:N), so protected compliance data is not exposed, and availability is not impacted (A:N), so no denial-of-service outcome is asserted. The attacker cannot pivot across a security boundary (S:U).

Impact Assessment

Business impact is moderate-to-low in direct technical severity but disproportionately sensitive in a compliance context, because Tanium Comply is a source of truth for endpoint compliance and vulnerability posture. CVSS 3.1 scores the vulnerability 4.3 (BASE) on AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N — no published Temporal or Environmental scores exist.

• Blast radius: Scoped to the Tanium Comply authorization domain (S:U). Exploitation requires a pre-existing low-privileged account (PR:L); unauthenticated external attackers are out of scope.
• Integrity (I:L): Unauthorized modification of records the attacker has no right to alter. In a compliance product, falsified or suppressed assessment data can undermine audit evidence, compliance attestations, and vulnerability-management decisions. That reputational and regulatory exposure frequently exceeds the raw CVSS integrity weighting.
• Confidentiality (C:N) / Availability (A:N): No data disclosure and no service disruption are asserted by the vector, so the direct technical impact is narrow.
• Exposure context: Tanium endpoints and consoles are predominantly internal assets, which constrains remote reachability despite AV:N. Hybrid management planes, partner integrations, or misconfigured perimeter exposures would materially raise real-world risk.
• Exploitation likelihood: Very low per current telemetry. EPSS 0.00152 (4.7th percentile) indicates almost no predicted exploitation activity; CVE is not in CISA KEV; no PoC, exploit code, or Nuclei template is public. Risk today is driven by insider threat, credential abuse, and authorized-pentest scenarios rather than mass opportunistic exploitation.

Detection Guidance

Because no exploit artifact exists, detections must target the behavioral signature of authorization-key tampering: an authenticated principal acting on resource identifiers outside their normal ownership scope, and anomalous write operations in Comply. The rules below are best-effort heuristic detections keyed to the vulnerability class and should be tuned to the deployment's real log schema.

Sigma Rule

title: Tanium Comply CWE-639 Authorization Bypass - Out-of-Scope Object Modification
id: 8f2c1a44-9d3e-4b21-a0c7-6e5b7c0a1f19
status: experimental
description: Detects write operations against Tanium Comply resources where the acting principal's
  scope does not match the referenced resource, consistent with CWE-639 user-controlled key abuse
  (CVE-2026-87019).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87019
author: valtersit.com
date: 2026/01/01
tags:
  - attack.privilege_escalation
  - attack.t1078
logsource:
  product: tanium
  service: comply
detection:
  selection_action:
    event.action|contains:
      - 'comply'
      - 'scan'
      - 'policy'
      - 'exemption'
  selection_method:
    http.request.method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
      - 'DELETE'
  selection_status:
    http.response.status_code:
      - 200
      - 201
      - 204
  selection_anomaly:
    user.scope_mismatch: true
  condition: selection_action and selection_method and selection_status and selection_anomaly
falsepositives:
  - Legitimate administrative write operations by scoped operators
  - Automated service accounts performing bulk compliance updates
level: medium

YARA Rule

rule CVE_2026_87019_Tanium_Comply_AuthzBypass_Probe
{
    meta:
        description = "Heuristic detection of tooling/scripts probing Tanium Comply object keys consistent with CWE-639 (CVE-2026-87019). Targets request-lines carrying caller-supplied object identifiers."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87019"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $comply = "comply" ascii nocase
        $scan   = "scan" ascii nocase
        $policy = "policy" ascii nocase
        $idkey1 = "id=" ascii nocase
        $idkey2 = "Id=" ascii nocase
        $idkey3 = "/id/" ascii nocase

    condition:
        uint16(0) == 0x4854 or uint16(0) == 0x5454 and
        filesize < 64KB and
        $comply and
        ( $scan or $policy ) and
        any of ($idkey*)
}

Note: this is a heuristic signature for captured request traffic or client-side tooling artifacts, not a vendor file signature. It keys on the combination of a Comply-related path token plus a caller-supplied identifier parameter, which is the behavioral fingerprint of CWE-639 key substitution.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87019 Tanium Comply CWE-639 Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"comply"; nocase; http.uri; pcre:"/(scan|policy|exemption)/i"; http.header; content:"Authorization"; nocase; reference:cve,2026-87019; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87019; classtype:attempted-user; sid:202687019; rev:1;)

Elastic Detection

sequence by user.name with maxspan=2m
  [ network where event.category == "network" and
      http.request.method in ("POST","PUT","PATCH","DELETE") and
      url.path : "*comply*" and
      url.path : ("*scan*" or "*policy*" or "*exemption*") and
      user.name != null ]
  [ network where event.category == "network" and
      http.response.status_code in (200,201,204) and
      url.path : "*comply*" ]

Splunk SPL Query

index=tanium sourcetype=tanium:comply OR sourcetype=proxy:http
| search (uri_path="*comply*" OR uri_path="*scan*" OR uri_path="*policy*" OR uri_path="*exemption*")
| where http_method IN ("POST","PUT","PATCH","DELETE")
| stats count AS write_ops dc(uri_path) AS distinct_paths values(http_response_status) AS statuses
        by src_ip, user, http_method
| where write_ops > 20 AND distinct_paths > 5
| table src_ip user http_method write_ops distinct_paths statuses
| sort - write_ops

Tune the write_ops/distinct_paths thresholds to the environment; the signal is a low-privileged principal performing an abnormally high volume of write operations across many distinct Comply resource paths.

Wazuh OSSEC Rule

<group name="tanium,comply,web,">
  <rule id="870190" level="10">
    <decoded_as>json</decoded_as>
    <field name="url.path">comply</field>
    <field name="http.request.method">POST|PUT|PATCH|DELETE</field>
    <field name="http.response.status_code">200|201|204</field>
    <description>CVE-2026-87019: Possible Tanium Comply authorization bypass (CWE-639) — write to out-of-scope Comply object.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source). The NVD text states that "Tanium addressed" the issue, but no fixed version, advisory ID, or build reference is available. Treat the estate as unpatched until Tanium confirms the fixed build.

1) Immediate mitigations (do today):

• Restrict network reachability of Tanium Comply consoles and APIs; enforce internal-only access and strong segmentation. Do not expose management planes to the internet.
• Apply least-privilege to all Tanium roles. Audit every existing low-privileged, contractor, and service account; remove stale accounts. Since PR:L is the only real barrier to exploitation, credential hygiene directly reduces risk.
• Enforce MFA on all Tanium console and API access, and rotate credentials/tokens for accounts that cannot be eliminated.
• Enable and centralize Tanium Comply audit/access logging and proxy/HTTP logging, and alert on the detections above.
• Treat compliance output as untrusted: cross-validate Tanium Comply assessment data against an independent source before relying on it for audit or remediation decisions.

2) Patch / upgrade steps:

• Open a case with Tanium support and request the advisory and fixed build for CVE-2026-87019; the NVD description confirms a fix was produced but no public version identifier exists.
• Monitor the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-87019) and Tanium's security advisory channel for the patch reference; apply as soon as it is published.
• After upgrading, re-run the detections above to confirm no residual out-of-scope write behavior, and re-verify role assignments.

3) Long-term hardening:

• Adopt a server-side authorization model that binds every object reference to the caller's identity and role (anti-IDOR design); require object-level authorization checks on all write paths, including API and agent channels — not just the UI.
• Implement automated regression testing for horizontal/vertical privilege escalation in Comply workflows.
• Enforce tamper-evident, append-only logging for compliance assessment records so post-hoc modification is detectable.
• Integrate Tanium patches into a vulnerability-management SLAs process; track Tanium advisories as a standing feed given the product's privileged position on endpoints.

References

1. NVD — CVE-2026-87019: https://nvd.nist.gov/vuln/detail/CVE-2026-87019
2. CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
3. Tanium Security Advisories (vendor advisory channel — confirm the fixed build and advisory ID): https://www.tanium.com/security/
4. FIRST EPSS (CVE-2026-87019 — score 0.00152, 4.7th percentile): https://api.first.org/data/v1/epss?cve=CVE-2026-87019
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-87019 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploitation status: No public PoC, no exploit code, no Nuclei template, and no threat-actor campaign are associated with CVE-2026-87019 in any tracked source. CISA KEV does not list this CVE. EPSS is near-floor at 0.00152 (4.7th percentile). Any exploit chain described in this report is inferred strictly from the CWE-639 vulnerability class and the published CVSS vector, not from observed in-the-wild activity.