CVE-2026-87023

Executive Summary

CVE-2026-87023 is a path traversal vulnerability (CWE-22) in Tanium Comply, an endpoint compliance and vulnerability assessment module of the Tanium platform. The flaw is remotely exploitable over the network by an authenticated low-privileged user and, because the vulnerable component operates within a security scope boundary different from the attacker's, successful exploitation yields high confidentiality impact — allowing an attacker to read files outside the intended access path. Tanium states a fix has been issued, but the affected version range, patch version, and any public proof-of-concept remain undisclosed, so defenders must treat this as a patch-now, verify-independently issue.

Technical Analysis

CVE-2026-87023 is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, commonly "Path Traversal"). The NVD description states only that "Tanium addressed a path traversal vulnerability in Comply." No CNA title, no function names, no endpoint paths, and no parameter names have been published in the intelligence provided. Accordingly, this analysis stays at the vulnerability-class level and does not invent implementation specifics.

Vulnerability class mechanics. Path traversal arises when an application accepts user-supplied input that is used — directly or after insufficient normalization — to construct a filesystem path, and the application fails to constrain the resulting path to an intended base directory. Classic mechanisms include the use of relative traversal sequences (e.g., ../ on POSIX-like systems or ..\ on Windows), absolute path injection, mixed or doubly-encoded traversal, and bypass techniques that evade naive filters (for example, alternate separators, overlong UTF-8 encodings, or filter-order mistakes). The attacker's objective is to cause the application to read or write a path the developer did not intend to expose.

Why the CVSS vector matters here. The published vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L:

• AV:N (Network) — the vulnerable interface is reachable over the network, not restricted to local access.
• AC:L (Low) — no special conditions or race window are required for the attack to succeed.
• PR:L (Low privileges required) — the attacker must be authenticated but needs only low-level privileges. This is the distinction that separates this CVE from an unauthenticated bug: it is a post-authentication traversal.
• UI:N (No user interaction) — no victim needs to click or approve anything.
• S:C (Scope Changed) — a successful exploit affects resources beyond the security authority of the vulnerable component. In path traversal terms, this typically means the attacker crosses out of the directory or data boundary the application was authorized to serve.
• C:H (High confidentiality), I:N (None integrity), A:L (Low availability) — the confirmed impact profile is read-oriented: sensitive files can be disclosed, with a limited availability side effect consistent with resource handling or error behavior during traversal attempts. No integrity impact is scored, meaning the published analysis does not describe a file-write or modification primitive.

Attack surface. Tanium Comply is deployed as part of the Tanium platform and performs compliance scanning and assessment across managed endpoints. The exploitable surface is the Comply service interface reachable over the network. Because the traversal is authenticated (PR:L), a valid low-privileged account on the Tanium deployment is a prerequisite. An attacker who cannot authenticate to the product cannot, per the published vector, trigger this flaw directly.

What we cannot confirm. The specific vulnerable parameter, the request endpoint, the exact traversal token accepted, whether the read primitive targets local filesystem paths on the server or content within a managed data store, and the affected product versions are all undisclosed in the supplied data. Any statement naming such specifics would be fabricated and is deliberately omitted.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-87023. The following attack chain is therefore inferred strictly from the vulnerability class (CWE-22) and the published CVSS vector, and does not assume any specific endpoint or parameter name.

1. Reconnaissance and target identification. The attacker identifies a reachable Tanium Comply deployment. Because the vector requires low privileges, the attacker must first obtain a valid low-privileged account — via credential reuse, a separate vulnerability, phishing, or a compromised service account within the environment. Reconnaissance focuses on confirming that the Comply service interface is network-accessible and that the attacker's account can reach the vulnerable functionality.

2. Triggering the path traversal. With an authenticated low-privileged session, the attacker submits input that the application uses to build a filesystem path, supplying traversal sequences or an absolute path rather than a legitimate value. The application processes the request without adequately constraining the resolved path to its intended base directory. The details of the exact parameter and request shape are not public; an operator must determine the exposed input surface on a per-deployment basis.

3. Payload and read primitive. At the vulnerability-class level, the objective is to traverse out of the intended directory and reference files outside it — for example, configuration or credential files on the underlying host. The published vector scores Confidentiality: High and Integrity: None, which means the exploitation profile is a file-read / disclosure primitive rather than a write or code-execution primitive. No command execution and no file modification are indicated by the CVSS scoring.

4. Post-exploitation impact. Disclosed files can include sensitive configuration, credentials, or other data readable by the Comply service account — a notable outcome given that Comply runs inside a Tanium-managed environment where endpoint and platform metadata concentrate. The Scope: Changed rating indicates the compromise extends beyond the vulnerable component's own security boundary. Low availability impact suggests exploitation may also degrade service behavior. As with any post-authentication traversal, the practical blast radius depends on the privileges of the service account under which Comply executes and the sensitivity of files readable by that account.

Caveat. The absence of a public PoC, the sparse NVD description, and the total lack of disclosed version ranges mean any step labeled "how to exploit" at a code or request level would be conjecture. Detection and mitigation should be built around the vulnerability class and the affected product, not around a hypothesized payload.

Impact Assessment

CVSS subscores and their business meaning.

• Exploitability: AV:N / AC:L / PR:L / UI:N. Exploitation is network-based, technically straightforward, requires a low-privileged authenticated account, and needs no user interaction. This is a low-friction exploit for an insider, a compromised low-privileged account holder, or an attacker who has already obtained a foothold in the Tanium environment.
• Scope: Changed (S:C) — the vulnerable component can be used to affect resources outside its own security authority. This is a significant escalation signal for defenders: a path traversal with scope change frequently acts as a stepping stone toward credential harvesting or lateral movement.
• Confidentiality: High (C:H) — the highest-impact dimension of this CVE. Arbitrary read of files reachable by the affected service is the primary risk, with downstream consequences including credential exposure and configuration disclosure.
• Integrity: None (I:N) — no modification primitive is scored; the attacker does not alter data via this vulnerability.
• Availability: Low (A:L) — minor service disruption is possible, not a full denial of service.

Blast radius. Tanium Comply is typically deployed to support organizational compliance and vulnerability posture management across a large estate of managed endpoints. The relevant blast radius is not the endpoints themselves but the server-side data and configuration readable by the affected component, plus any credentials or secrets stored in filesystem locations the service can reach. Because Tanium is itself a high-value platform in most enterprises, a disclosure bug within it should be treated with elevated suspicion of follow-on activity.

Contextual risk signals.

• CISA KEV: NO — not currently listed as exploited in the wild by CISA.
• EPSS: 0.00303 (23.0th percentile) — the model rates near-term exploitation probability as low in absolute terms, but the low-volume EPSS score for a sparse, post-auth CVE should not be read as "ignore"; it reflects limited public signal, not low intrinsic severity.
• CVSS 8.5 (High) — the severity rating is driven by the scope change and high confidentiality impact, not by exploitability volume.

Detection Guidance

The detection content below is written defensively and at the discovery level. Because no endpoint, parameter, or payload is disclosed, the rules emphasize: (a) traversal-pattern detection in web/API requests to Tanium Comply, and (b) post-exploitation behavioral indicators on the host. Analysts must tune paths, process names, and ports to their own deployment. All rules are illustrative templates pending validation in the reader's environment.

Sigma Rule

title: Potential Path Traversal Against Tanium Comply
id: 7c5f9a12-4b2e-4a0e-9d31-8f6a2c1b7e90
status: experimental
description: Detects HTTP requests containing path traversal sequences targeting the Tanium Comply service interface.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87023
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: tanium
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e%5c'
      - '%252e%252e%252f'
      - '....//'
      - '..;/'
  filter_benign:
    cs-uri-query|contains:
      - '/wamui-'
  condition: selection_method and selection_traversal and not filter_benign
falsepositives:
  - Legitimate administrative requests containing encoded dots
  - Security scanners and fuzzers during authorized testing
level: high
tags:
  - attack.t1190
  - cve.2026.87023

YARA Rule

rule CVE_2026_87023_Tanium_Comply_PathTraversal
{
    meta:
        description = "Detects path traversal payloads targeting Tanium Comply (CVE-2026-87023) in request artifacts, logs, or capture files"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87023"
        cve = "CVE-2026-87023"

    strings:
        $trav_a = "../" ascii
        $trav_b = "..\\" ascii
        $trav_c = "%2e%2e%2f" ascii nocase
        $trav_d = "%2e%2e%5c" ascii nocase
        $trav_e = "%252e%252e%252f" ascii nocase
        $trav_f = "..%2f" ascii nocase
        $trav_g = "....//" ascii
        $prod_1 = "Tanium" ascii wide nocase
        $prod_2 = "Comply" ascii wide nocase

    condition:
        uint16(0) == 0x0A0D or
        ( $prod_1 and $prod_2 and 1 of ($trav_*) ) or
        ( 2 of ($trav_*) )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87023 Possible Path Traversal Against Tanium Comply"; flow:established,to_server; http.uri; content:".."; content:"/"; distance:0; pcre:"/(\.\.(%2f|\/))|(%2e%2e(%2f|\/))|(\.\.%5c)|(\.\.\\\\)/i"; reference:cve,2026-87023; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87023; classtype:attempted-recon; sid:2026870231; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence Low;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where network.protocol == "http"
      and url.path != null
      and (url.path : "*/../*" or url.path : "*/..\\*"
           or url.query : "*..%2f*" or url.query : "*%2e%2e%2f*"
           or url.query : "*%2e%2e%5c*" or url.query : "*%252e%252e%252f*") ]

Splunk SPL Query

index=web OR index=proxy OR index=tanium
(sourcetype="access_combined" OR sourcetype="tanium:comply" OR sourcetype="stream:http")
(uri=*"../"* OR uri=*"..%2f"* OR uri=*"%2e%2e%2f"* OR uri=*"%2e%2e%5c"* OR uri=*"%252e%252e%252f"* OR uri=*"....//"*)
| eval risk="high"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris
        by src_ip, dest_ip, status
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="tanium,comply,web,attack,">
  <rule id="100720" level="12">
    <if_sid>31100,31101,31103,31104,31106</if_sid>
    <id>^403$|^404$</id>
    <regex>\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c|%252e%252e%252f</regex>
    <description>CVE-2026-87023: Possible path traversal attempt against Tanium Comply</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87023,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (NVD) states that Tanium addressed the issue. No vendor advisory, CVE record version range, or specific fixed build was supplied in the intelligence for this report. Do not treat the patch as independently verified until confirmed against Tanium's official release notes.

1. Immediate mitigations (apply while validating the patch).

• Restrict network access to the Tanium Comply service interface to trusted management networks and known administrative subnets; do not expose it to untrusted internal segments or the internet.
• Enforce least privilege on Tanium accounts: audit and reduce the population of low-privileged accounts (PR:L), and require strong MFA so that credential compromise — the precondition for exploitation — is harder to achieve.
• Run the service under a minimally-privileged OS account so that any traversal read primitive reaches the smallest feasible set of files.
• Apply the detection content above and alert on traversal patterns against the Comply interface.

2. Patch and upgrade steps.

• Consult Tanium's official security advisories and release notes directly to obtain the fixed Comply/Tanium version and the full affected version range for CVE-2026-87023 (not published in the data used for this report).
• Stage the update in a non-production Tanium deployment first, then roll out to production in a controlled window.
• After upgrading, verify the installed build matches Tanium's stated fixed version — a claim of a fix is not proof the running instance has it.
• Rotate any credentials or secrets stored in filesystem locations readable by the Comply service as a precaution against pre-patch exfiltration.

3. Long-term hardening.

• Maintain an inventory and continuous version tracking for Tanium modules (Comply included) so version-specific advisories can be matched to deployed builds instantly.
• Harden the input-validation layer: canonicalize and resolve paths before use, reject traversal sequences and absolute paths, and constrain file access to an explicit allowlisted base directory — the standard CWE-22 remediation pattern.
• Platform-wide: segment the Tanium management plane from general user traffic, enforce MFA everywhere, and continuously monitor for anomalous post-auth reads of configuration or credential files.
• Track CVE-2026-87023 for updates — the affected version range and any in-the-wild reporting may emerge after initial publication; EPSS and KEV status should be rechecked periodically.

References

1. NVD — CVE-2026-87023 — https://nvd.nist.gov/vuln/detail/CVE-2026-87023
2. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') — https://cwe.mitre.org/data/definitions/22.html
3. CVSS v3.1 Specification — https://www.first.org/cvss/v3.1/specification-document
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-87023 not listed as of this writing) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. Tanium Security Advisories — https://security.tanium.com/ (consult for the authoritative affected-version range and fixed build; not present in the supplied intelligence)

Threat actor / exploitation note. No public proof-of-concept, exploit code, Nuclei template, or in-the-wild exploitation evidence exists for CVE-2026-87023 in the provided data. EPSS is low (0.00303, 23.0th percentile) and the CVE is not in CISA KEV. There are no known threat-actor campaigns associated with this vulnerability at the time of writing. This report should be revised if a vendor advisory, version range, or exploitation reporting is published.