CVE-2026-87025

Executive Summary

CVE-2026-87025 is an improper access control vulnerability (CWE-639 — Authorization Bypass Through User-Controlled Key) in Tanium Comply, a compliance and vulnerability management module within the Tanium platform. The flaw carries a CVSS v3.1 base score of 5.4 (Medium) and requires authenticated access with low privileges (PR:L) over the network (AV:N). An attacker could exploit this weakness to perform unauthorized modification of data and cause partial availability loss, as reflected in the Integrity (I:L) and Availability (A:L) subscores; confidentiality is unaffected (C:N). A public proof-of-concept is reportedly available, though no exploit code or Nuclei template is currently listed, and the vulnerability is not in CISA KEV. Organizations running Tanium Comply should prioritize patching and validate proper authorization enforcement on Comply endpoints.

Technical Analysis

CVE-2026-87025 is classified under CWE-639, "Authorization Bypass Through User-Controlled Key." This weakness class occurs when an application uses a user-supplied identifier (such as an object ID, key, or reference parameter) to look up a resource but fails to verify that the requesting user is authorized to access or modify that resource. The result is an access control bypass that allows a low-privileged authenticated user to reach objects or operations that should be restricted to higher-privileged roles or specific ownership scopes.

The CVSS vector — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L — informs the attack profile precisely:

• AV:N (Network): The vulnerable interface is reachable over the network, so no physical or local-only access is required.
• AC:L (Low): No special conditions, timing windows, or complex preconditions are needed; the attack is repeatable and straightforward given the required privileges.
• PR:L (Low): The attacker must hold a valid low-privileged account on the Tanium Comply instance. This is not an unauthenticated flaw.
• UI:N (None): No victim interaction is required — the attacker acts independently.
• S:U (Unchanged): The exploit does not cross a security authority boundary; impact is scoped to the vulnerable Comply component.
• C:N / I:L / A:L: There is no confidentiality impact. Integrity impact is Low, meaning an attacker can modify some data but with limited scope or constrained consequence. Availability impact is Low, indicating the attacker can partially disrupt availability (for example, by altering or degrading a compliance data set) without fully shutting the system down.

The NVD description is deliberately terse: "Tanium addressed an improper access controls vulnerability in Comply." It does not disclose specific endpoints, parameter names, object-key semantics, or affected version ranges. Consequently, the exact user-controlled key and the affected API surface cannot be stated without fabrication. What can be stated with confidence is the vulnerability class: an authenticated, low-privileged user can supply a manipulated identifier that the application fails to validate against their authorization scope, thereby reaching or mutating resources beyond their entitlement. In a compliance management product like Tanium Comply, resources of this type typically include scan results, compliance policies, configuration baselines, endpoint group assignments, and exemption records — any of which, if tampered with via a keyed lookup, could distort compliance posture reporting or degrade data integrity.

Two characteristics raise operational significance despite the Medium score. First, the vulnerability is remotely reachable and low-complexity — a persistent low-privileged foothold (a compromised service account, an over-provisioned operator, or a phished credential) is sufficient. Second, a public PoC is reported, which lowers the barrier to reproduction. The absence of a CISA KEV listing and the low EPSS (0.00170, ~6.7th percentile) indicate no confirmed exploitation in the wild at time of writing, but EPSS is a probabilistic metric and should not be treated as an all-clear.

Because the affected version range is not populated in the intelligence data (Affected Versions: []), defenders must consult the vendor advisory directly to determine the precise fixed build. Patch confidence is 2/4 (CLAIMED) — NVD asserts the vendor addressed the issue, but this has not been independently confirmed and no explicit patch version is given, so verification against Tanium's own release notes is mandatory.

Exploitation Scenarios

Important: No public exploit code is listed and the NVD description contains no endpoint, parameter, or function-level detail. The following chain is derived from the CWE-639 class and the CVSS vector. No specific function names, API paths, or parameter names are asserted, because none are provided in the source data.

1. Reconnaissance / Target Identification. The attacker identifies a network-reachable Tanium Comply deployment. Because the flaw requires authentication (PR:L), the attacker's objective at this stage is to obtain any valid low-privileged credential — through credential stuffing, phishing, purchasing access on an initial-access brokerage, or abusing a separate over-permissioned integration account. The attacker also maps which Comply resources are addressed by user-controllable identifiers (record IDs, group references, policy identifiers) by observing normal application traffic.

2. Triggering the Flaw Class. Authorization bypass through user-controlled key (CWE-639) is triggered by taking a legitimate request that references a resource by a user-supplied key and substituting a key that belongs to a resource the attacker is not authorized to touch. Because the application performs the lookup by the supplied key without re-validating the caller's authorization against that resource's owner or scope, the request succeeds. The precise key and request method are not specified in the available intelligence and cannot be enumerated here without inventing details.

3. Payload / Execution Method (class level). No code execution payload is involved. Exploitation is an authorization logic abuse: the "payload" is the manipulated identifier within an otherwise well-formed request. The attacker iterates or enumerates valid keys to reach objects outside their entitlement, relying on the Low attack complexity (AC:L) to script the process.

4. Post-Exploitation Impact. Consistent with the CVSS subscores, the attacker gains the ability to modify data (I:L) and degrade availability (A:L) within the Comply component — for example, altering or invalidating compliance records — while confidentiality is unaffected (C:N). Because the scope is Unchanged (S:U), impact does not propagate beyond the Comply security authority. The practical effect is a corruption of compliance posture and potential disruption of compliance workflows, not data theft or code execution.

Defenders should treat "public PoC" as reported but unverified in this dataset. Validate against the vendor advisory before assuming exploitability specifics.

Impact Assessment

CVSS v3.1 Base: 5.4 (Medium) — AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

• Confidentiality (C:N): No data disclosure. This is a material mitigating factor — the flaw is not an exfiltration risk.
• Integrity (I:L): An authenticated attacker can make limited unauthorized modifications. In a compliance product, integrity of scan results, policy definitions, or baseline data underpins audit and regulatory reporting; corruption of these records can produce inaccurate compliance conclusions.
• Availability (A:L): Partial degradation of the affected component's function is possible, but not total loss.

Blast radius. Scoped to the Tanium Comply component (S:U). The blast radius is bounded by (a) the requirement for a valid low-privileged account and (b) the Low integrity/availability weighting. The most consequential business impact is trust in compliance and audit data — if an over-provisioned operator or a compromised account can silently alter compliance records, downstream governance, regulatory attestations, and remediation prioritization may be based on manipulated inputs.

Likelihood drivers. Public PoC availability and Low attack complexity increase the likelihood of opportunistic exploitation once a low-privileged account is obtained. The low EPSS and absence from CISA KEV suggest low current exploitation activity, but the vulnerability remains attractive for insider-threat and post-initial-access scenarios where the attacker already holds credentials.

Detection Guidance

Detection must focus on authorization-anomaly behavior: a low-privileged account issuing requests that touch resources outside its normal scope, or rapid enumeration of identifiers. Because the exact endpoints and parameters are undisclosed, the rules below are written generically and require tuning to the local Comply deployment.

Sigma Rule

title: Potential Tanium Comply Improper Access Control - Anomalous Resource Access
id: 8f2c1b7e-4a6d-4e21-9c3f-000000870025
status: experimental
description: Detects low-privileged accounts accessing or modifying Tanium Comply resources
  with identifiers outside their expected scope (CWE-639 authorization bypass).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87025
author: valtersit.com
date: 2026/01/01
logsource:
  product: tanium
  service: comply
detection:
  selection_access:
    event_type:
      - 'comply_resource_access'
      - 'comply_policy_update'
      - 'comply_scan_result_modify'
  selection_privilege:
    user_role:
      - 'read_only'
      - 'operator'
      - 'low_privilege'
  condition: selection_access and selection_privilege
falsepositives:
  - Legitimate administrative bulk operations
  - Service accounts with documented elevated scope
level: medium
tags:
  - attack.t1190
  - cwe.639

Note: Field names are illustrative placeholders; map to the actual Tanium audit log schema before deployment.

YARA Rule

rule CVE_2026_87025_Tanium_Comply_Access_Control_Artifact
{
    meta:
        author = "valtersit.com"
        description = "Detects request artifacts referencing Tanium Comply resources with manipulated object keys (CWE-639). Tune to deployment."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87025"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $comply = "comply" nocase
        $tanium = "tanium" nocase
        $keyref = /(id|key|groupId|policyId)=/ nocase
        $tamper = /(modify|update|delete|override)/ nocase

    condition:
        ($comply or $tanium) and $keyref and $tamper
}

Rationale: YARA is file-content oriented; this rule targets captured request bodies, logs, or memory artifacts containing Comply resource references combined with identifier-key and mutation keywords. It is a heuristic aid, not an endpoint signature.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87025 Potential Tanium Comply Authorization Bypass - Object Key Tampering"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"comply"; nocase; http.uri; content:"id="; nocase; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-user; sid:202687025; rev:1; reference:cve,2026-87025; metadata:service http;)

Note: Content match is generic ("comply" + "id=") to avoid fabricating endpoints. Tune URI patterns to the actual Comply API and correlate with authentication context at the proxy/WAF layer.

Elastic Detection

sequence by user.name with maxspan=2m
  [authentication where event.outcome == "success"]
  [network where
     url.path : "*comply*" and
     url.query : ("*id=*" or "*key=*") and
     user.name : * ]

Note: EQL over audit/auth + network events. Requires URL fields to be populated. Adjust url.path patterns to match the local Tanium Comply URL namespace.

Splunk SPL Query

index=tanium sourcetype=tanium:comply:audit
| where match(lower(user_role), "read_only|operator|low_privilege")
| where match(lower(uri), "comply") AND (match(lower(uri), "id=") OR match(lower(uri), "key="))
| stats count values(uri) as uris dc(uri) as distinct_uris by user, src_ip
| where distinct_uris > 20
| sort - distinct_uris

Detects a low-privileged user enumerating many distinct Comply resource identifiers in a short window — consistent with key enumeration during authorization bypass.

Wazuh OSSEC Rule

<group name="tanium,comply,access_control,">
  <rule id="870025" level="10">
    <decoded_as>json</decoded_as>
    <field name="app">tanium-comply</field>
    <field name="user_role">read_only|operator|low_privilege</field>
    <field name="action">modify|update|delete</field>
    <regex field="uri">comply.*(id|key)=</regex>
    <description>CVE-2026-87025: Low-privileged account modified/accessed Tanium Comply resource via user-controlled key</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Note: Requires JSON log decoding for Tanium Comply audit events; field names must match the deployed decoder.

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source (NVD) claims patch; not independently confirmed). No explicit fixed version is provided in the intelligence data.

1) Immediate mitigations

• Restrict network exposure of Tanium Comply management interfaces to trusted management networks / VPN; do not expose to the public internet.
• Enforce least privilege: audit all Tanium Comply roles and remove or downgrade over-provisioned accounts. Since PR:L is the only barrier to exploitation, shrinking the population of low-privileged-but-broadly-scoped accounts directly reduces risk.
• Enable and centralize audit logging for Comply resource access and mutations; alert on low-privileged accounts touching resources outside their scope (see Detection Guidance).
• Rotate credentials for any account suspected of compromise; monitor for anomalous identifier enumeration.

2) Patch / upgrade steps

• Consult the official Tanium advisory and release notes to identify the exact fixed version, since the affected range is not populated here.
• Test the fixed build in a staging environment, verify alignment with existing Comply configurations, then deploy across production.
• Given CLAIMED patch confidence from a single source, independently validate the fix by confirming the vendor's own release notes explicitly reference this CVE before closing remediation tickets.
• If the fixed version is not yet available to your deployment, apply the immediate mitigations above and maintain compensating controls.

3) Long-term hardening

• Adopt object-level authorization (ownership/scope checks) as a design standard for all identifier-keyed APIs; treat user-supplied keys as untrusted.
• Implement continuous authorization testing (automated IDOR/key-tampering test suites) in the SDLC.
• Maintain a periodic review cadence for Tanium (and all platform) role assignments.
• Track CVE-2026-87025 and related advisories for updates to affected-version data, patch confirmation, and any change in exploitation status (e.g., future KEV addition).

References

1. NVD — CVE-2026-87025 — https://nvd.nist.gov/vuln/detail/CVE-2026-87025 (authoritative description, CVSS, CWE-639 mapping)
2. Tanium Security Advisories / Release Notes — consult the official Tanium advisory portal for the Comply fix version and affected-release details (vendor source; patch confirmation pending independent verification).
3. CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html (vulnerability-class reference for attack mechanics)
4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-87025 is not currently listed; monitor for future addition)
5. FIRST EPSS — https://www.first.org/epss (EPSS 0.00170, ~6.7th percentile as of data capture)

Exploit-in-the-wild / threat actor note: No CISA KEV listing, no confirmed exploit code, and no named threat-actor campaign are associated with CVE-2026-87025 in the provided data. A "Public" PoC status is reported; treat as unverified. No campaign attribution is asserted.