CVE-2026-87033

Executive Summary

CVE-2026-87033 is an improper access controls vulnerability (CWE-639, Authorization Bypass Through User-Controlled Key) in Tanium Comply, a compliance and vulnerability management module of the Tanium endpoint management platform. The flaw carries a CVSS v3.1 base score of 5.4 (Medium), exploitable by an authenticated network-adjacent attacker with low privileges, allowing limited integrity and availability impact within the affected component. No public proof-of-concept, Nuclei template, or exploit code is available, and the CVE is not listed in CISA KEV; EPSS is 0.00170 (6.7th percentile), indicating low near-term exploitation likelihood.

Technical Analysis

The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key. This weakness class occurs when an application uses a key (such as a record identifier, tenant ID, account GUID, or object reference) supplied or influenced by the user to directly access a data object, without verifying that the requesting principal is authorized to access that specific object. The practical consequence is that a low-privileged authenticated user can interact with objects belonging to other users, roles, or tenants by manipulating the key value in a request.

The NVD description states: "Tanium addressed an improper access controls vulnerability in Comply." This is the totality of the technical detail available from the authoritative source. No function names, API endpoints, parameter names, file paths, or code-level constructs are disclosed in the NVD description or CNA title. Accordingly, this report deliberately does not fabricate implementation specifics. What can be stated with confidence:

• Vulnerability class: Horizontal or vertical authorization bypass via user-controlled object reference (IDOR-class weakness).
• Attack surface: The network-facing interface of Tanium Comply — the component accepts requests over the network (AV:N) that reference objects by an identifier supplied by the caller.
• Authentication requirement: Low privileges are required (PR:L), meaning the attacker must already hold a valid, low-privileged account in the Tanium environment. This is not an unauthenticated flaw.
• No user interaction: UI:N — the exploit does not depend on a victim clicking or confirming anything.
• Scope: S:U — the impact is confined to the Comply component's security authority; exploitation does not demonstrably pivot to affect resources beyond it.
• Confidentiality impact: C:N — the CVSS vector indicates no confidentiality impact, which is notable for an access-control flaw. This suggests the bypass enables modification or disruption of accessible objects rather than disclosure of protected data. Analysts should treat the C:N rating as a scoring artifact rather than absolute proof that no data exposure is possible, but must not overstate exposure in the absence of evidence.

The integrity (I:L) and availability (A:L) subscores are both Low, consistent with an attacker being able to alter or disrupt a limited set of objects — for example, compliance scan configurations, policy assignments, or result records — that fall outside their intended authorization scope. The AC:L rating indicates no special conditions or race windows are required; a straightforward request with a manipulated key suffices.

Because the affected version range was not published and no CVE-specific advisory text was captured, the precise object type and interface (REST API, console, or inter-service call) cannot be confirmed from available data.

Exploitation Scenarios

No public PoC or exploit code is available. The following chain is inferred strictly from the CWE-639 class and the CVSS vector — it does not assert specific endpoints, parameters, or code paths, none of which are disclosed.

1. Reconnaissance and target identification. The attacker requires valid low-privileged credentials to the Tanium environment. Initial access to such credentials may come from phishing, credential reuse, or a compromised lower-privileged operator account. The attacker enumerates the Comply interface (typically the Tanium Console and its underlying API), observing object identifiers returned in responses — policy IDs, scan IDs, group IDs, or similar integer/GUID references used to address records.

2. Triggering the flaw class. With a legitimate session, the attacker issues requests that reference an object by its user-controllable key, substituting an identifier belonging to another user, role, or scope. Because the application fails to validate that the caller is authorized for the referenced object (the CWE-639 condition), the request is served. No privilege escalation primitive or memory-corruption condition is involved — the bypass relies solely on the omission of an ownership/authorization check against the supplied key.

3. Execution / payload method. At the vulnerability-class level, "payload" here is simply a crafted request containing a manipulated object reference. Since AC:L applies, no timing, encoding, or race condition is needed. The attacker repeats the request across a range of identifiers to map which objects are reachable — classic enumeration of an IDOR-class weakness.

4. Post-exploitation impact. Consistent with I:L and A:L, the attacker can make limited unauthorized modifications to, or disrupt the availability of, in-scope Comply objects — for example altering or disabling compliance policy assignments or scan results within a scope they should not control. The CVSS C:N rating bounds the expected data-disclosure impact. There is no evidence in the provided data of remote code execution, lateral movement, or scope change, and none should be assumed.

Impact Assessment

• Business context: Tanium Comply underpins regulatory compliance scanning and vulnerability assessment across managed endpoints. Integrity or availability degradation of compliance data undermines audit integrity and can mask or falsify compliance posture — a governance and reporting risk even when raw confidentiality impact is rated nil.
• Affected systems: Deployments of Tanium Comply at the specific (unpublished) vulnerable versions. The absence of a stated version range means operators must rely on vendor-supplied update guidance rather than a self-service version check.
• Blast radius: Constrained by S:U and C:N. An authenticated low-privileged actor can reach only the object classes exposed by the flawed authorization check within Comply; no evidence supports cross-scope compromise beyond that component.
• CVSS subscores: AV:N (network-reachable), AC:L (no special conditions), PR:L (valid low-priv account needed), UI:N (no victim interaction), S:U (no scope change), C:N / I:L / A:L (limited integrity and availability effects). Base 5.4 — Medium.
• Threat landscape: EPSS 0.00170 (6.7th percentile) and not in CISA KEV. No known exploitation in the wild, no PoC, no template. Near-term weaponization risk is low, though the low complexity means a capable insider or compromised low-privileged account could reproduce it once the interface is understood.

Detection Guidance

Note: Because no endpoint, parameter, or payload specifics are disclosed, the following rules are behavioral/class-level detections for authorization-bypass (IDOR) activity against Tanium Comply. They must be tuned to the actual deployment; field names and product strings may require adjustment and are provided as detection scaffolding, not as confirmed indicators.

Sigma Rule

title: Potential Tanium Comply Authorization Bypass - Object Reference Enumeration (CVE-2026-87033)
id: 8c2f1a44-9d1e-4a7b-b6f2-87033tanium
status: experimental
description: Detects sequences of Comply API requests referencing many distinct object identifiers by a single low-privileged principal, consistent with CWE-639 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87033
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: tanium
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/comply/'
      - '/plugin/comply/'
  selection_status:
    sc-status: 200
  selection_user:
    cs-username|exists: true
  timeframe: 5m
  condition: selection_path and selection_status and selection_user | count() by cs-username, c-ip > 50
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate bulk compliance reporting or automated scan enumeration
  - Administrative bulk operations
level: medium
tags:
  - attack.t1190
  - cve.2026.87033

YARA Rule

rule CVE_2026_87033_Tanium_Comply_Authz_Bypass_Indicators
{
    meta:
        description = "Detects references to CVE-2026-87033 / Tanium Comply authorization bypass in artifacts, logs, or exploit tooling"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87033"
        date = "2026-01-01"
        cve = "CVE-2026-87033"

    strings:
        $cve    = "CVE-2026-87033" ascii nocase
        $cwe    = "CWE-639" ascii nocase
        $tanium = "Tanium Comply" ascii nocase
        $comply = "/comply/" ascii nocase

    condition:
        any of ($cve, $cwe) or
        ( $tanium and $comply )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87033 - Possible Tanium Comply Authorization Bypass (object reference enumeration)"; flow:established,to_server; http.uri; content:"/comply/"; http.method; content:"GET"; http.header; content:"Authorization"; threshold:type both, track by_src, count 50, seconds 300; classtype:attempted-recon; reference:cve,2026-87033; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87033; sid:2026870330; rev:1;)

This rule is heuristic and intended to flag high-rate, authenticated GET enumeration against the Comply URI space. It will require adaptation to the actual URI structure, which is not disclosed in authoritative sources.

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http where http.request.method == "GET" and url.path : "/comply/*"]
  [http where http.request.method == "GET" and url.path : "/comply/*"]
  [http where http.request.method == "GET" and url.path : "/comply/*"]

This EQL sequence fires when a single user/IP issues repeated GET requests to the Comply URI space in rapid succession — a behavioral signal for object-reference enumeration associated with CWE-639 bypass. Tune maxspan and the number of sequence steps to deployment baselines.

Splunk SPL Query

index=web OR index=tanium sourcetype=access_combined OR sourcetype=tanium:comply
| search uri_path="/comply/*" status=200
| stats count AS requests, dc(uri_path) AS distinct_paths, dc(cookie) AS sessions BY src_ip, user
| where requests > 50 AND distinct_paths > 20
| sort - requests
| table src_ip, user, requests, distinct_paths, sessions

This query surfaces a single principal generating many successful requests across many distinct Comply paths — an enumeration signature consistent with authorization-bypass probing. No CVE-specific field names are assumed because none are disclosed.

Wazuh OSSEC Rule

<group name="tanium,comply,web,">
  <rule id="100733" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>/comply/</url>
    <status>^200$</status>
    <description>CVE-2026-87033: Repeated successful access to Tanium Comply endpoints by a single user - possible authorization bypass enumeration</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87033,</group>
  </rule>
</group>

This rule assumes HTTP access-log ingestion and URL-based decoding. Frequency-based correlation (e.g., <frequency>50</frequency><timeframe>300</timeframe>) should be added if the log source supports it; default Wazuh web rules vary by deployment.

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. NVD states the vulnerability was "addressed" by Tanium, but no independent confirmation, patched version identifier, or vendor advisory text was captured in the source data.

1. Immediate mitigations

   • Restrict network access to Tanium Comply/Console interfaces to trusted management networks and authorized administrative hosts; do not expose Comply management surfaces to broad user networks.
   • Review and minimize low-privileged operator accounts; enforce least privilege and role separation so that users cannot address objects outside their intended scope.
   • Increase logging and monitoring on Comply interfaces (see Detection Guidance) to identify enumeration activity against object references.
   • Rotate/audit credentials for low-privileged accounts, since PR:L is a prerequisite for exploitation.

2. Patch / upgrade steps

   • Contact Tanium support or consult the Tanium customer portal / release notes for the version that "addressed" CVE-2026-87033, as no version string is publicly specified here.
   • Apply the vendor-recommended update to Tanium Comply and any dependent platform components.
   • Validate post-patch that authorization checks are enforced by testing object-reference isolation with a low-privileged account in a controlled environment.

3. Long-term hardening

   • Implement server-side, object-level authorization checks (do not trust client-supplied keys to determine access) — the core CWE-639 remediation pattern.
   • Adopt role-based access control with per-object ownership validation and deny-by-default semantics across all Comply APIs.
   • Integrate authorization-bypass (IDOR) test cases into secure SDLC and periodic penetration testing.
   • Maintain an inventory of exposed management-plane interfaces and continuously monitor for unexpected external accessibility.

References

1. National Vulnerability Database — CVE-2026-87033: https://nvd.nist.gov/vuln/detail/CVE-2026-87033
2. CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
3. Tanium Product Security / Trust Center (vendor advisory and patch guidance), accessible via the Tanium customer portal: https://www.tanium.com/
4. FIRST EPSS — score and percentile context: https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-87033 NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: None available. CISA KEV: NO. No public PoC, Nuclei template, or exploit code identified. EPSS 0.00170 (6.7th percentile). Exploitation in the wild has not been observed in the provided data.