CVE-2026-87021

Executive Summary

CVE-2026-87021 is an unauthorized code execution vulnerability in Tanium Comply, a module within the Tanium endpoint management platform that provides continuous security configuration assessment and compliance monitoring. The vulnerability is rooted in CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), indicating that attacker-controlled input is improperly sanitized before being processed by a server-side template engine, enabling server-side template injection (SSTI) that leads to arbitrary code execution. The vulnerability carries a CVSS score of 7.2 (High) with a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, meaning an authenticated attacker with high privileges (or one who has compromised a low-privilege account) can exploit the flaw over the network without user interaction, achieving full confidentiality, integrity, and availability impact. Tanium Comply is widely deployed in enterprise environments for CIS benchmark auditing, vulnerability scanning, and policy compliance; a successful exploit grants an attacker the ability to execute arbitrary code on the underlying server hosting the Comply module. Critically, no patch is currently available (patch confidence: 0/4), and no public exploit code or proof-of-concept has been disclosed. Organizations running Tanium Comply should treat this as an active risk and implement the mitigations outlined in this report.

Technical Analysis

Vulnerability Class: Server-Side Template Injection (CWE-1336)

CWE-1336 describes a vulnerability class where user-controlled input is concatenated into a template string that is subsequently evaluated by a server-side template engine (e.g., Jinja2, Freemarker, Velocity, Twig). Unlike client-side template injection, SSTI occurs entirely on the server, and a successful injection allows the attacker to execute arbitrary template expressions — which, in most modern template engines, can be leveraged to call underlying system functions and achieve full remote code execution (RCE).

The NVD description is terse: "Tanium addressed an unauthorized code execution vulnerability in Comply." Despite the claim of a fix, our patch confidence is 0/4, meaning no patch, commit, or version bump has been confirmed from any tracked source. The description confirms the vulnerability is in the Comply module and permits unauthorized code execution.

Attack Mechanism

Although exact technical details are not disclosed, the vulnerability class (CWE-1336) informs the likely attack mechanism:

1. Input Field Reception: The Tanium Comply web interface or API likely accepts user-supplied input meant to be rendered into a template — for example, a compliance report template name, a custom policy description, a notification message, or a query string field.

2. Template Concatenation: The input is concatenated directly into a template string without prior neutralization or escaping. For instance, a template expression such as {{7*7}} embedded in the input may be interpreted by the template engine rather than displayed literally as text.

3. Expression Evaluation: Because template engines evaluate embedded expressions, an attacker can submit payloads like {{constructor.constructor('require('child_process').exec('COMMAND')')()}} (in a Node.js environment) or equivalent expressions for Python/Jinja2, Java/Freemarker, or other supported engines.

4. Code Execution: The evaluated expression results in the invocation of system commands, file read/write, or network operations with the privileges of the Tanium Comply server process.

Attack Surface

• Attack Vector: Network (AV:N) — the Comply web console or its API is reachable over the network.
• Attack Complexity: Low (AC:L) — no special conditions, race conditions, or advanced techniques are required.
• Privileges Required: High (PR:H) — the attacker must authenticate to the Comply module with an account that has sufficient permissions to reach the template-injectable functionality. This could be an admin or a role with template/report management rights.
• User Interaction: None (UI:N) — exploitation does not require tricking another user.
• Scope: Unchanged (S:U) — the compromise is confined to the template engine's execution context (the underlying server), not a broader security boundary crossing.

Insufficient Technical Detail

The NVD description does not specify:

• The programming language or template engine (Jinja2, Freemarker, Velocity, etc.).
• The exact HTTP endpoint(s) or parameter name(s) that accept the injectable input.
• The affected Tanium Comply version range.
• Whether exploitation is pre-authentication or requires a specific role.

As such, this analysis is based on the vulnerability class (CWE-1336) and the CVSS vector; no implementation-specific details have been fabricated.

Exploitation Scenarios

Important Caveat: No public PoC is available; the attack chain is inferred from the SSTI vulnerability class (CWE-1336) and the CVSS vector. Specific payload structures may vary depending on the template engine used by Tanium Comply, which is undisclosed at this time.

Step 1 — Reconnaissance / Target Identification

An attacker who has already obtained high-privilege credentials to the Tanium environment — or who is performing penetration testing against a target organization — would first identify the Comply module's console or API endpoint. This could be discovered through:

• Network scanning for Tanium-specific ports/services.
• Reviewing documentation or API references for template-based features (report generation, notification content, policy definitions).
• Shodan queries for exposed Tanium consoles (e.g., product:"Tanium" or http.html:"Tanium").

The attacker authenticates with their privileged account and proceeds to enumerate features that accept free-form text destined for a template engine.

Step 2 — Triggering the Template Injection

The attacker locates a function in Comply that renders user-controlled content into a server-side template, such as:

• A custom report template field.
• A policy description or compliance rule message.
• A notifications/alert configuration field that compounds text into a rendered email or dashboard.

The attacker submits a benign test payload first — e.g., ${{7*7}} or {{7*7}} — and observes whether the output returns 49 (indicating server-side evaluation) rather than the literal string. This confirms the injection point.

Step 3 — Payload Execution

Once the injection point is confirmed, the attacker crafts a template expression that escapes the template engine's sandbox and invokes operating system commands. At the class level, the payload:

• Accesses the template engine's underlying object model (e.g., __class__, __base__, __subclasses__ in Python, or constructor/prototype in JavaScript).
• Chains references to reach a system call capability.
• Executes a command such as reverse shell, data exfiltration, or credential harvesting.

Example class-level pattern (Python/Jinja2):

{{ cycler.__init__.__globals__.os.popen('id').read() }}

Or Java/Freemarker/EL equivalent. The payload's output is rendered back in the HTTP response, confirming RCE.

Step 4 — Post-Exploitation Impact

With code execution on the Comply server, an attacker can:

• Data Exfiltration: Read compliance reports, system configuration, credential stores, and secrets from the server's filesystem.
• Lateral Movement: Use the compromised server's position in the network to pivot toward domain controllers, databases, or other infrastructure.
• Persistence: Install backdoors, create user accounts, or modify Comply's own templates to maintain covert access.
• Ransomware / Data Destruction: Execute destructive commands on the Comply host.

Because the CVSS vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H), the Comply server's compromise is likely to have significant downstream effects on the managed endpoints and compliance posture of the entire organization.

Impact Assessment

Business Impact

Tanium Comply is a component of the Tanium unified endpoint management (UEM) platform, widely deployed in large enterprises, government agencies, and highly regulated industries to enforce CIS benchmarks, DISA STIGs, and NIST frameworks. The Comply module specifically automates configuration auditing across thousands of endpoints. A compromise of the Comply server therefore has consequences that extend far beyond a single host:

1. Compliance Integrity Loss: An attacker who executes code on the Comply server can falsify compliance reports, hide non-compliant states, or mark malicious configuration changes as "compliant." This undermines audit results and could mask active threats or policy violations.
2. Credential Exposure: Comply servers typically hold privileged credentials used to authenticate to managed endpoints (e.g., domain admin or local admin accounts). Exfiltration of these credentials enables broader network compromise.
3. Regulatory Consequences: For organizations subject to PCI DSS, HIPAA, SOX, or government mandates, a compliance tool compromise that falsifies audit data could trigger regulatory fines, loss of certification, and breach notification obligations.
4. Ransomware Risk: The Comply server's network position and high privilege level make it an attractive initial foothold for a ransomware operator, who could leverage it to deploy encryptors to managed endpoints.

Affected Systems

• Product: Tanium Comply module.
• Platform: Comply runs as a server-side component; the deployed instances of Comply are the vulnerable surface.
• Version: Unknown (no affected version range disclosed by the vendor).
• Patch Status: UNPATCHED — 0/4 patch confidence from all tracked sources.

CVSS Subscore Analysis

• C:H/I:H/A:H (9.0 combined Impact sub-score): The vulnerability allows total loss of data confidentiality, integrity, and availability on the target server.
• PR:H (Privileges Required — High): Exploitation requires an authenticated high-privilege account. This tempers the criticality from a purely remote, unauthenticated perspective, but in a UEM platform context, high privilege equates to significant administrative reach.
• AV:N/AC:L/UI:N (Exploitability sub-score 6.6): No special conditions or user interaction; the network exposure means any compromised admin account becomes a direct RCE vector into the compliance infrastructure.

Blast Radius

• Immediate: The Comply server host OS.
• Extended: All managed endpoints whose compliance data is processed by the compromised Comply instance (potentially thousands of devices).
• Systemic: The organization's overall compliance, security monitoring, and incident-response capabilities, as an attacker in the Tanium environment can disable audits, alter reports, and erase forensic evidence.

Detection Guidance

The following detection guidance is written generically to the SSTI/RCE class; since the template engine and specific endpoints are unknown, detection rules focus on characteristics that apply broadly to the vulnerability.

Note: No known IOC, command-and-control channel, or attacker signature is available, and the vendor has not published exploit signatures. These rules aim to detect anomalous template expression attempts or post-exploitation behavior on the Comply server.

Sigma Rule

title: Tanium Comply Server-Side Template Injection Attempt
id: 0f4d2a76-4f0d-4b1a-9a7d-02a37c0ff196
status: experimental
description: Detects potential SSTI payload signatures in HTTP requests or logs destined for Tanium Comply servers.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-87021
author: Valters IT Security Research
date: 2026/04/15
logsource:
    category: webserver
    product: iis
    definition: Requires web server access logs from the Tanium Comply server or a reverse proxy fronting it.
detection:
    selection_ssti_math:
        cs-uri-query|contains:
            - '{{7*7}}'
            - '${{7*7}}'
            - '#{7*7}'
            - '<%= 7*7 %>'
            - '${7*7}'
    selection_ssti_payload:
        cs-uri-query|contains:
            - '{{'
            - '__class__'
            - '__globals__'
            - 'constructor'
            - 'child_process'
            - 'os.popen'
            - 'Freemarker'
            - 'Runtime.getRuntime'
    condition: selection_ssti_math or selection_ssti_payload
    level: high
falsepositives:
    - Legitimate use of template syntax in report configuration (unlikely in normal URI traffic).
    - Scanning from authorized vulnerability assessment tools.
fields:
    - c-ip
    - cs-method
    - cs-uri-stem
    - cs-uri-query

YARA Rule

rule Detect_SSTI_Payload_Tanium_Comply {
    meta:
        author = "Valters IT Security Research"
        description = "Detects SSTI payloads in HTTP request bodies or logs associated with Tanium Comply exploitation"
        reference = "CVE-2026-87021"
        date = "2026-04-15"
        severity = "high"
    strings:
        $a = "{{7*7}}"
        $b = "${{7*7}}"
        $c = "__class__"
        $d = "__globals__"
        $e = "constructor.constructor"
        $f = "child_process"
        $g = "os.popen"
        $h = "Runtime.getRuntime"
        $i = "Template" ascii nocase
        $j = "comply" ascii nocase
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or filesize < 10MB
        and ($j in (0..filesize) or $i in (0..filesize))
        and (any of ($a, $b) or any of ($c, $d, $e, $f, $g, $h))
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET TROJAN Tanium Comply SSTI Exploitation Attempt (CVE-2026-87021)"; flow:to_server,established; content:"POST"; http_method; content:"comply"; http_uri; nocase; content:"{{"; http_client_body; distance:0; pcre:"/(\{\{|__class__|__globals__|os\.popen|child_process|Runtime\.getRuntime)/Ui"; sid:202687021; rev:1; classtype:attempted-admin; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87021; metadata:created_at 2026_04_15, updated_at 2026_04_15;)

Elastic Detection

// Detection for SSTI payloads in HTTP request bodies or responses on Tanium Comply servers
sequence by host.name, destination.ip
  [network where event.type == "start" and destination.port in (443, 8443, 8080) and process.name == "w3wp.exe" or process.name == "java"]
  [file where process.name == "java" or process.name == "w3wp.exe" and event.action == "write" and file.name : ("*.jsp", "*.class", "*.jar", "*.log") and file.path : "*comply*"]
  [process where event.type == "start" and (
      process.command_line : ("*os.popen*", "*Runtime.getRuntime*", "*child_process*", "*exec*", "*wget*", "*curl*")
      or process.command_line : ("*powershell*", "*cmd.exe*", "*/bin/sh*")
    ) and process.parent.name : ("java", "w3wp.exe")]

Splunk SPL Query

index=web OR index=proxy OR sourcetype="iis" (uri_query="*{{*" OR uri_query="*}}$*" OR uri_query="*%7B%7B*" OR uri_query="*__class__*" OR uri_query="*__globals__*" OR uri_query="*os.popen*" OR uri_query="*child_process*" OR uri_query="*Runtime.getRuntime*")
  OR (sourcetype="WinEventLog:Sysmon" EventCode=1 (CommandLine="*curl*" OR CommandLine="*wget*" OR CommandLine="*powershell*") (Image="*java*" OR Image="*w3wp.exe*" OR Image="*comply*"))
  OR (sourcetype="WinEventLog:Sysmon" EventCode=11 TargetFilename="*comply*templates*")
| table _time, src_ip, dest_ip, dest_port, uri, uri_query, CommandLine, TargetFilename
| sort -_time

Wazuh OSSEC Rule

<group name="local,tanium,comply,ssti,">
  <rule id="100870" level="12" frequency="5" timeframe="60">
    <decoded_as>json</decoded_as>
    <field name="event.module">apache.access</field>
    <match>comply</match>
    <regex>\{\{</regex>
    <description>Tanium Comply: Potential Server-Side Template Injection (SSTI) payload detected in HTTP request.</description>
    <group>ssti,rce,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100871" level="12" frequency="3" timeframe="120">
    <decoded_as>json</decoded_as>
    <field name="command">.*(__class__|__globals__|os\.popen|Runtime\.getRuntime|child_process).*</field>
    <description>Tanium Comply: SSTI exploitation chain - template object traversal or OS command payload observed in process execution.</description>
    <group>rce,execution,</group>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch, security update, or version reference is available from any tracked source, including the NVD, Tanium, or third-party researchers. The NVD description states "Tanium addressed" the issue, but this claim cannot be verified against any actual release. Do not assume the vulnerability is fixed unless Tanium officially confirms the specific patched version.

1) Immediate Mitigations (Apply Today)

• Restrict Network Access: Limit access to the Tanium Comply console and API to trusted internal IPs only. Place the Comply server behind a firewall/proxy that enforces allow-listing. If remote access is required, use a VPN with MFA.
• Strengthen Authentication (MFA): Enforce multi-factor authentication on all Tanium administrative accounts. Since the CVSS vector requires high privileges, attackers are most likely to exploit this after compromising an admin account — MFA substantially raises the bar.
• Audit Active Sessions and Privileged Accounts: Review all current admin sessions; revoke any that are stale or from unknown source IPs. Check for newly created accounts in the Comply/Tanium user directory.
• Monitor for Template Payload Patterns: Deploy the detection rules above (Sigma, Splunk, Suricata) to alert on SSTI payload signatures. Review any alerts that match the pattern immediately.
• Maintain Defense-in-Depth on the Host: Run endpoint detection and response (EDR) on the Comply server. Ensure file integrity monitoring watches critical directories and configuration files.
• Application Control: If available, use application control on the Comply server to restrict which processes can spawn child processes — this can blunt post-exploitation command execution.
• Disable Unnecessary Features: If certain Comply features (e.g., custom report templates, policy editor) are not actively used across the organization, consider disabling them or restricting their use to a small team.

2) Patch/Upgrade Steps

Because no patch has been confirmed, the following steps are contingent on Tanium releasing a fixed version:

1. Monitor Tanium's Official Channels: Regularly check Tanium's security advisory page, release notes, and support portal for an advisory referencing CVE-2026-87021.
2. Subscribe to Vendor Notifications: Register with Tanium's security notification list to receive updates as soon as they are published.
3. Upon Patch Release: Upgrade the Tanium Comply module to the patched version in a staging environment first, verify compatibility with your existing Tanium server version and policy configurations, then roll out to production using Tanium's standard deployment procedures.
4. If NVD Description is Accurate: If "Tanium addressed" implies a previous fix that was later reverted or was incomplete, verify that your deployed version includes the vendor's fix — contact Tanium support to confirm your exact build is patched.

3) Long-Term Hardening

• Least-Privilege for Comply: Review the service account the Comply server runs as. It should have only the permissions needed to perform compliance checks on endpoints — no more. Consider separating the Comply server account from broader Tanium admin roles.
• Network Segmentation: Isolate the Comply server on a dedicated administrative network segment. Restrict east-west traffic from the Comply server to only the necessary management ports and endpoints.
• Credential Vaulting: Remove hardcoded/static credentials from Comply configuration files; use a secrets-management solution (e.g., HashiCorp Vault, CyberArk) instead.
• Regular Vulnerability Scanning: Schedule periodic authenticated scans of the Tanium infrastructure as part of your standard patch-management cycle.
• Penetration Testing: Include the Tanium environment (including Comply) in annual third-party penetration tests.
• Monitor the Threat Landscape: Track exploitation attempts in the wild by subscribing to threat intel feeds and CISA alerts. Although CISA KEV currently does not list this CVE, that status can change rapidly once a PoC surfaces.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-87021
2. Tanium Security Advisories (monitor for official patch announcement): https://www.tanium.com/support/security-advisories/
3. CWE-1336 Reference (MITRE): Improper Neutralization of Special Elements Used in a Template Engine — https://cwe.mitre.org/data/definitions/1336.html
4. CISA Known Exploited Vulnerabilities Catalog (not currently listed — monitor for updates): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat-Actor Campaign Evidence

As of the writing of this report:

• No known threat actor campaigns have been reported in connection with CVE-2026-87021.
• No exploit-in-the-wild evidence has been observed.
• No PoC or exploit code is publicly available.
• CISA KEV: Not listed.

This situation may change rapidly; organizations running Tanium Comply should treat their installations as sensitive and monitor the Tanium advisory page and threat-intel feeds at least weekly until a patch is verified.