CVE-2026-87030

Executive Summary

CVE-2026-87030 is a path traversal vulnerability (CWE-22) in Tanium Comply, the compliance assessment and vulnerability management module of the Tanium endpoint management platform. A network-reachable, authenticated low-privilege attacker can supply crafted path input that causes the affected component to access or write files outside its intended directory, with a CVSS 3.1 base score of 8.5. The scored impact is integrity-high with a scope change and low availability impact, meaning a successful attack can modify data outside the vulnerable component's security authority — potentially reaching adjacent system resources — while requiring only low-privilege credentials and no user interaction.

Technical Analysis

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., "Path Traversal"). Tanium's NVD description states only that "Tanium addressed a path traversal vulnerability in Comply." No specific module, endpoint, parameter, file path, or function name is disclosed in the available intelligence, so the following analysis is confined to the vulnerability class and its implications.

Path traversal in a server-side product such as Tanium Comply arises when user-controllable input is incorporated into a filesystem path without adequate canonicalization and containment checks. Typical vulnerable patterns include:

• Using attacker-supplied names directly in file open/read/write calls without resolving ../ sequences or absolute paths.
• Failing to validate that the resolved path remains within a designated data, upload, or configuration directory (the classic "realpath prefix check" omission).
• Trusting encoded traversal sequences (%2e%2e%2f, double-encoded variants, backslash on Windows, or Unicode-normalized dot sequences) that are decoded after a naive check.

Because the CVSS vector is AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L, several properties are relevant:

• AV:N — the vulnerable surface is reachable over the network, consistent with a web/API service rather than a purely local binary.
• PR:L — exploitation requires a valid low-privileged account to reach the vulnerable code path, so this is a post-authentication issue, not a pre-auth remote code execution bug.
• S:C (Scope Changed) — the affected component's exploitation can affect resources beyond its own security scope. In path traversal, this is the signature of reading or writing outside the intended directory boundary into other parts of the filesystem or into components under different privilege.
• C:N / I:H / A:L — there is no scored confidentiality impact, high integrity impact, and low availability impact. This asymmetry strongly implies a write-oriented traversal (the ability to place or overwrite files) rather than a pure arbitrary-file-read bug. Note that real-world impact may exceed the score if the write target is subsequently executable or consumed by another component.

The change of scope combined with high integrity impact is the key risk multiplier: if an attacker can control a path used for file deposition, the recorded integrity of compliance assessment data, reports, or configuration consumed by other Tanium modules may be considered compromised.

Exploitation Scenarios

No public technical write-up, Nuclei template, or exploit code is available in the provided data. The following chain is therefore inferred from the vulnerability class (CWE-22) and must not be treated as a confirmed step-by-step exploit.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-reachable Tanium Comply interface (web UI or API). Because exploitation requires authentication (PR:L), the attacker first needs a valid low-privilege account — via legitimate access, stolen credentials, or a separate credential-access technique. Shodan/HTTP fingerprinting for Tanium-branded portals can identify candidate hosts.

2. Triggering the flaw class. Once authenticated, the attacker interacts with the request parameter that maps to a filesystem path (e.g., a name, report, export, or file-handling field). They inject traversal sequences (../, encoded variants, or absolute paths) so that the server-side path resolves outside the intended directory. The specific parameter name is not disclosed in the available data and is intentionally not fabricated here.

3. Payload/execution at the class level. For a write-oriented traversal, the attacker causes the application to place attacker-controlled content at a location outside the designated directory — potentially overwriting configuration, data, or files consumed by a different component (consistent with the S:C scope change). For a read-oriented variant, the attacker retrieves files beyond the intended boundary.

4. Post-exploitation impact. Consequences align with the scored metrics: high integrity impact (data/files modified outside scope), low availability impact (targeted file unavailability or service disruption), and scope change (effects beyond the vulnerable component). There is no scored confidentiality impact, but operators should not assume arbitrary read is impossible given the CVSS score alone.

The presence of a public PoC flag and the absence of exploit code/templates in this dataset means defenders should prioritize detection over assumption of an imminent weaponized exploit.

Impact Assessment

• Business impact: Tanium Comply is used for compliance posture and vulnerability assessment across managed endpoints. Compromise of its data integrity can lead to falsified compliance results, corrupted reports, or manipulated configuration — undermining the security decisions an organization makes from that data.
• Affected systems: Deployments of Tanium Comply exposed to a network-reachable interface and reachable by users holding low-privilege accounts.
• Blast radius / scope: The CVSS S:C score change indicates the effect can cross a security boundary, so collateral impact to adjacent components or the host filesystem is plausible. The I:H subscore makes data-integrity exposure the dominant risk.
• Exploit prerequisites: Network reachability (AV:N), no special complexity (AC:L), and low-privilege authentication (PR:L), with no user interaction (UI:N). This lowers the bar to exploitation for any actor who already holds a foothold credential.
• EPSS: 0.00282 (≈20.8th percentile), indicating a low modeled near-term exploitation probability. CISA KEV: NO — no confirmed exploitation in the wild as of this writing.

Detection Guidance

Because the exact endpoint and parameter are undisclosed, the following rules detect the generic path-traversal class against Tanium-facing services. Tune paths, hostnames, and product-specific markers to the deployment.

Sigma Rule

title: Tanium Comply Path Traversal Attempt (CVE-2026-87030)
id: 7b1c4a92-5f0e-4d3a-9c21-3e6a8d2f0b17
status: experimental
description: Detects path traversal sequences in HTTP requests to Tanium Comply
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87030
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
      - PUT
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%252e%252e%252f'
      - '....//'
      - '/etc/passwd'
      - 'C:\\Windows'
  selection_tanium:
    cs-uri-stem|contains:
      - 'comply'
      - 'tanium'
  condition: selection_method and selection_traversal and selection_tanium
falsepositives:
  - Authorized penetration testing
  - Vulnerability scanners
level: high

YARA Rule

rule CVE_2026_87030_Tanium_Comply_Traversal
{
    meta:
        description = "Detects path traversal exploitation attempts against Tanium Comply in web/proxy logs"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87030"
        author = "valtersit.com"
        date = "2026-01-01"
        cve = "CVE-2026-87030"

    strings:
        $t1 = "../" ascii wide nocase
        $t2 = "..\\" ascii wide nocase
        $t3 = "%2e%2e%2f" ascii wide nocase
        $t4 = "%252e%252e" ascii wide nocase
        $t5 = "comply" ascii wide nocase
        $t6 = "tanium" ascii wide nocase

    condition:
        (any of ($t1, $t2, $t3, $t4)) and (any of ($t5, $t6))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87030 Tanium Comply Path Traversal Attempt"; flow:established,to_server; http.uri; content:".."; nocase; http.uri; content:"comply"; nocase; http.uri; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%252e%252e)/i"; classtype:attempted-admin; reference:cve,CVE-2026-87030; sid:202687030; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where http.request.method in ("GET","POST","PUT")
      and process.name != null
      and stringContains(http.request.uri, "comply") ]
  [ network where http.request.method in ("GET","POST","PUT")
      and (stringContains(http.request.uri, "../")
           or stringContains(http.request.uri, "..\\")
           or stringContains(http.request.uri, "%2e%2e%2f")) ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, url, cs_uri)
| where match(uri, "(?i)(comply|tanium)")
| where match(uri, "(?i)(\.\./|\.\.\\|%2e%2e%2f|%252e%252e)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| sort - count

Wazuh OSSEC Rule

<group name="tanium,cve-2026-87030,web,">
  <rule id="2026870" level="12">
    <if_sid>31100</if_sid>
    <match>\.\./|\.\.\\|%2e%2e%2f</match>
    <match>comply|tanium</match>
    <description>CVE-2026-87030: Possible path traversal attempt against Tanium Comply</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. The single source (NVD) states that "Tanium addressed" the issue, but no fixed version string or vendor advisory URL is provided in this dataset. Treat the patch as claimed but unverified in this report and confirm directly with Tanium.

1. Immediate mitigations

   • Restrict network access to Tanium Comply interfaces to trusted management networks and authorized administrators; do not expose it to untrusted networks.
   • Enforce least privilege and review low-privilege accounts (PR:L) that can reach the vulnerable code path; disable or rotate unused credentials without delay.
   • Where a web application firewall can be tuned, block requests containing traversal sequences (../, encoded variants) against Comply paths.

2. Patch/upgrade steps

   • Contact Tanium support or review Tanium's release notes/security advisories to identify the fixed Comply version for CVE-2026-87030.
   • Stage and test the update in a non-production environment, then roll out to all Comply deployments.
   • Re-scan after patching to confirm the fix is present.

3. Long-term hardening

   • Enforce robust path canonicalization and directory-containment checks (CWE-22 mitigation) for any file-handling code, including post-decoding validation.
   • Run with least-privilege service accounts so that path traversal cannot reach sensitive filesystem areas.
   • Continuously monitor for anomalous filesystem writes outside intended directories.
   • Maintain asset inventory and vulnerability management for all Tanium modules.

References

• NVD — CVE-2026-87030: https://nvd.nist.gov/vuln/detail/CVE-2026-87030
• CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Tanium Security Advisories (verify the advisory and fixed version for Comply): https://security.tanium.com/
• CISA KEV catalog (CVE-2026-87030 is not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-wild note: No confirmed in-the-wild exploitation, threat actor campaign, or CISA KEV listing is associated with CVE-2026-87030 based on the provided data. EPSS is low (0.00282). The public PoC flag should prompt proactive exposure assessment, but no weaponized exploit artifact is present in this dataset. Re-check vendor and government sources for updates, as patch and exploit status may change.