CVE-2026-87032

Executive Summary

CVE-2026-87032 is an information disclosure vulnerability affecting Tanium Server. The flaw allows an authenticated, low-privileged network attacker to access sensitive information due to insufficient access controls. Tanium Server is an enterprise endpoint management platform, so this vulnerability may expose internal configuration details or management data to authorized-but-unauthorized users. With a CVSS score of 4.3 (medium severity), the exposure is limited in confidentiality impact and carries no integrity/availability consequences. Critically, no vendor patch is currently confirmed from tracked sources, leaving affected environments without a known remediation path.

Technical Analysis

Vulnerability Classification: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Mechanism Overview: The NVD description states only that "Tanium addressed an information disclosure vulnerability in Tanium Server." Per NVD, the CNA assigned a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating:

• Attack Vector (AV:N): Network-reachable — no local access required.
• Attack Complexity (AC:L): No special conditions or race conditions; trivial to exploit.
• Privileges Required (PR:L): Valid low-privilege account credentials are needed.
• User Interaction (UI:N): No victim interaction.
• Scope (S:U): Confined to the vulnerable component.
• Confidentiality (C:L): Limited information is exposed.

Attack Surface: Specific function names, endpoints, or file paths are not disclosed in the NVD description. At the vulnerability-class level, CWE-200 in a server component typically manifests through one of several patterns: overly permissive API responses that return more fields than the requesting role should see; access-control failures that let lower-privilege users query administrative datasets; verbose error messages/env files/backup files served over HTTP; or IDOR-style enumeration of objects (reports, agents, policies) without object-level authorization checks.

Code-Level Analysis: Insufficient technical detail is available in the NVD description to identify exact affected functions or request parameters. We must not fabricate implementation specifics. The vulnerability class, however, strongly implies an authorization gap within Tanium Server's handling of authenticated API or web requests where server-side checks fail to sufficiently filter sensitive fields or records for low-privilege principals.

Affected Versions: Not specified in the provided data (listed as empty). This absence likely means the NVD record itself lacks version-range detail; patch confidence is 0/4 from all tracked sources.

Exploitation Scenarios

No public PoC or exploit code is available per the provided data. The attack chain below is inferred strictly from the vulnerability class and CVSS metadata.

1. Reconnaissance / Target Identification: The attacker gains or possesses valid low-privilege credentials to a Tanium Server instance (e.g., a standard operator/read-only account). Target discovery uses Shodan/Censys queries for Tanium management interfaces (product:Tanium, http.title:"Tanium"). The attacker enumerates the server's HTTP(S) API surface.

2. Flaw Trigger: Because the weakness is an information disclosure via insufficient authorization (CWE-200, low complexity, network reachable), the attacker issues authenticated HTTP requests to server endpoints that should be restricted. The trigger likely involves crafting API queries (e.g., requesting object lists, reports, or configuration endpoints) that the attacker's low-privilege role should not be able to access.

3. Payload / Execution Method: No payload amplification is required; standard HTTP GET/POST requests against legitimate endpoints suffice. The server fails to enforce fine-grained access-control checks on response data, returning sensitive fields (credentials, tokens, internal hostnames, other tenants' data, or patch/configuration details) alongside otherwise benign results.

4. Post-Exploitation Impact: The attacker exfiltrates the exposed information. Depending on the nature of the leak, this could support further attacks: harvested credentials or API tokens could enable lateral movement or privilege escalation toward full administrative control of the Tanium environment, escalating impact beyond the C:L rating of the individual CVE.

Impact Assessment

• CVSS 4.3 (Medium) — underscores limited direct severity: only confidentiality (L) is impacted; no integrity/availability loss, low-privilege prerequisite, no user interaction.
• Business Impact: Moderate. For a management plane like Tanium Server, even low-sensitivity data leakage can reveal internal network architecture, agent deployment IDs, organizational structure, or partial policy data — useful intel for an advanced attacker staging a more significant campaign.
• Affected Systems: Tanium Server (product name per NVD description; specific versions unknown).
• Blast Radius: Confined per the S:U component — a component-level, not organizational-wide, breach. However, the strategic value of Tanium (full endpoint visibility/control with agent deployment across fleets) means any foothold on its management data plane is a high-value target.
• Exploitability: Low complexity + network vector means real-world exploitation does not require advanced skills once credentials are obtained.
• CISA KEV: NO — not yet known to be exploited in the wild.

Detection Guidance

Detection for this flaw is best approached generically — since no public PoC exists and no signature is available, detections should target anomalous access patterns to Tanium management endpoints from low-privilege accounts.

Sigma Rule

title: Tanium Server Information Disclosure - Privileged Endpoint Access by Low-Privilege User
id: 5a4b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects authenticated Tanium Server requests from accounts classified as low-privilege that target administrative or sensitive endpoints, indicative of CVE-2026-87032 exploitation attempts.
logsource:
    product: tanium
    service: server
detection:
    selection_low_priv:
        user.privileges: ["low", "read-only", "operator"]
    selection_sensitive_endpoint:
        url.path|contains:
            - "/api/admin"
            - "/api/config"
            - "/api/reports"
            - "/api/policies"
    condition: selection_low_priv and selection_sensitive_endpoint
falsepositives:
    - Legitimate read-only audit workflows requiring access to report generation endpoints
    - Misconfigured role assignments granting low-privilege accounts access to more than intended
level: medium

YARA Rule

rule Tanium_InfoDisclosure_CVE_2026_87032
{
    meta:
        author = "Valter Security Research"
        description = "Detects Tanium Server HTTP response fragments indicative of sensitive data exposure patterns consistent with CVE-2026-87032"
        date = "2026-05-01"
        cve = "CVE-2026-87032"
    strings:
        $s1 = "/api/admin" ascii nocase
        $s2 = "/api/config" ascii nocase
        $s3 = "/api/reports" ascii nocase
        $s4 = "auth_token" ascii nocase
        $s5 = "session_token" ascii nocase
        $s6 = "X-Tanium-Server-API" ascii nocase
    condition:
        filesize < 10KB and
        (uint16(0) == 0x0D0A and // headers or payloads (crlf)
        (2 of ($s1, $s2, $s3)) and
        (any of ($s4, $s5, $s6)))
}

Suricata IDS Rule

alert http any any -> $TANIUM_SERVERS any (msg:"CVE-2026-87032 - Tanium Server Information Disclosure Probe (Low-Privilege Access to Sensitive Endpoint)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/admin"; nocase; http.uri; content:"/api/config"; nocase; http.uri; content:"/api/reports"; nocase; reference:cve,2026-87032; classtype:attempted-recon; sid:8703201; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [authentication where
      event.action == "authentication_success" and
      user.name == "svc_tanium_operator" and
      source.ip != "127.0.0.1"]
  [http where
      event.module == "tanium" and
      url.path like "*api*" and
      (url.path like "*reports*" or
       url.path like "*policies*" or
       url.path like "*config*" or
       url.path like "*admin*") and
      user.name == "svc_tanium_operator"]

Splunk SPL Query

index=tanium sourcetype=tensor:access_logs
| where like(url, "%/api/%")
| search (url="*admin*" OR url="*config*" OR url="*reports*")
| lookup tanium_user_roles username AS user OUTPUT role
| where role IN ("operator", "read_only")
| stats count by user, src_ip, url, _time
| sort - _time

Wazuh OSSEC Rule

<group name="tanium_server,">
  <rule id="100870" level="10">
    <decoded_as>JSON</decoded_as>
    <field name="auth.user.role">operator|read_only</field>
    <field name="request.uri">\./api/(admin|config|reports|policies)</field>
    <description>CVE-2026-87032: Tanium Server info disclosure — low-privilege user access to sensitive API</description>
    <mitre>
      <id>T1005</id>
    </mitre>
    <group>access_control_failure,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: Patch confidence is 0/4 from all tracked sources — unpatched, with no vendor fix or workaround confirmed by evidence. This rating indicates not merely "no patch available" but no publicly detectable patch release, advisory, or hotfix referenced by the vendor.

Immediate Mitigations (until a patch is shipped):

1. Apply principle of least privilege — audit all Tanium Server user/role assignments; revoke access for low-privilege accounts to administrative and report-generating functionality unless strictly required for operational duties.
2. Network segmentation — restrict management-plane access to the Tanium Server to a dedicated jump-host network/VLAN via firewall policy; disallow direct internet exposure.
3. Enable verbose auditing — turn on Tanium Server audit logging for all API/UI access; ship logs to the SIEM and alert per the detection rules above.
4. Temporary role lockdown — if feasible, place suspected sensitive API endpoints behind an additional authentication layer (reverse proxy) requiring MFA or an elevated token.

Patch/Upgrade Guidance:

• Monitor Tanium's official security bulletin portal and the NVD record CVE-2026-87032 for the release of an official advisory. Since the NVD description uses the phrasing "Tanium addressed…", it is plausible a fix exists in a recent (or forthcoming) version but has not yet appeared in indexed sources. Contact Tanium Technical Support for direct confirmation of affected builds and remediation versions if you are a licensed customer.
• Upon release of a patched build, review the Tanium Server release notes, schedule an upgrade during a maintenance window, and validate the patch against pre-production instances.

Long-Term Hardening:

• Enforce multi-factor authentication (MFA) for all Tanium console and API users.
• Integrate Tanium Server logs into enterprise SIEM with alerting on anomalous access patterns.
• Develop a recurring credential-leak detection process to lower the probability of an authenticated attacker leveraging low-privilege accounts.
• Participate in vendor-supported channels to receive advance notification of security patches.

References

• NVD Entry for CVE-2026-87032: https://nvd.nist.gov/vuln/detail/CVE-2026-87032
• Tanium Security Advisory Portal (monitor for official update): https://www.tanium.com/resources/security/
• CWE-200 Definition (MITRE): https://cwe.mitre.org/data/definitions/200.html
• ATT&CK Technique T1005 — Data from Local System (relevant escalation of impact): https://attack.mitre.org/techniques/T1005/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaigns or evidence of in-the-wild exploitation were identified at the time of this report.