CVE-2026-87035

Executive Summary

CVE-2026-87035 describes an information disclosure vulnerability in Tanium Comply, the compliance and configuration assessment module of the Tanium endpoint management platform. The vulnerability allows a low-privileged, network-accessible attacker to retrieve sensitive information accessible to the product, with no user interaction required. The NVD describes the flaw tersely — lacking a CNA title, affected version range, or patch information — meaning the exact attack vector and data-at-risk are currently under-described. Tanium Comply is widely deployed in enterprise environments for CIS benchmark and STIG compliance auditing, so an authenticated low-privilege user in such an environment could leverage this flaw to read compliance posture data, endpoint configuration secrets, or internal policy details, in turn facilitating further lateral movement or privilege escalation. With a CVSS base score of 4.3 (medium severity), exploitation is plausible given the low attack complexity and lack of user interaction, though no public proof-of-concept exists and Tanium has not confirmed a patch at the time of reporting.

Technical Analysis

The NVD description for CVE-2026-87035 is minimal — "Tanium addressed an information disclosure vulnerability in Comply" — and is entirely devoid of implementation details. No CNA title, affected version range, patch identifier, or vendor advisory reference is provided in the CVE record. As such, any specific technical analysis must be derived from the vulnerability class (CWE-200, Exposure of Sensitive Information to an Unauthorized Actor) and the known architecture of Tanium Comply, without fabricating endpoint details or function names.

From the CVSS vector — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N — we can derive the following precise characteristics:

• Attack Vector (AV:N): The flaw is exploitable over the network; the attacker does not need physical or local access.
• Attack Complexity (AC:L): No race condition, user interaction, or mitigating security controls must be bypassed. The exploit path is straightforward.
• Privileges Required (PR:L): A valid low-privilege account on the platform (or the underlying OS of a managed endpoint) is necessary. This is consistent with the Comply product functioning as a management-plane component — the attacker is likely an authenticated, but non-administrative, user of the Tanium console or an endpoint agent.
• User Interaction (UI:N): No victim action (e.g., clicking a link or opening a file) is required to trigger the disclosure.
• Scope (S:U): The vulnerable component and the affected resource reside within the same security authority. The information leak is confined to the Tanium environment; the attacker cannot pivot outside that trust boundary.
• Confidentiality Impact (C:L): The disclosure is limited — only a subset of low-sensitivity data is exposed. Typically this maps to data such as system configuration flags, compliance settings, audit log metadata, or non-secret structural data — not full credential stores or encryption keys.
• Integrity (I:N) and Availability (A:N): The flaw purely leaks data; no modification or denial-of-service is possible.

The attack surface is the Tanium Comply module, which performs continuous configuration assessment against frameworks (CIS, STIG, NIST). Such systems inherently hold per-endpoint configuration state, installed-software inventories, and service account settings, any of which could be disclosed. Insufficient technical detail is available to state the exact parameter, API endpoint, or data structure that is leaked; it is plausible that the issue resides in how Comply exposes assessment results, asset metadata, or comparison baselines to authenticated-but-unprivileged console users. The lack of an affected version range and patch makes it impossible to determine whether the flaw is recent (introduced in a newer release) or long-standing, though Tanium's "addressed" phrasing implies an internal fix is in development or was quietly shipped.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-87035, and no Nuclei template or YARA rule has been published. The attack chain below is therefore inferred strictly from the vulnerability class (authenticated information disclosure in a network-accessible management component) and the CVSS attributes. All steps are described at a class level, absent confirmed implementation specifics.

Step 1 — Reconnaissance / Target Identification: An attacker with valid low-privilege credentials (obtained via credential stuffing, phishing, or legitimate but confined user account) first enumerates the Tanium environment. They identify the Comply module's console URL or API listener, which is network-reachable (AV:N). Network scanning for Tanium-specific ports (often 17472 for the module server communication) or browsing the console UI would suffice to fingerprint the deployment. The attacker confirms the Comply module is active — evidenced by dashboard widgets or API responses indicating compliance assessment data.

Step 2 — Triggering the Information Disclosure: With an authenticated session established, the attacker sends crafted HTTP requests to the Comply-facing functional surface — likely a console UI call or REST endpoint that retrieves compliance assessment data or per-endpoint configuration snapshots. Because the attack vector is network-based and complexity is low, the attacker does not need to chain additional vulnerabilities, race conditions, or user interaction. If the endpoint in question is designed to render data to the attacker's authenticated role but fails an authorization check on specific sensitive fields, the disclosure occurs naturally: the server response includes the confidential content alongside the legitimate low-privilege content. The class-level mechanism is thus a missing or insufficient authorization check on a data retrieval function, allowing data intended for privileged roles (e.g., compliance administrators or auditors) to be rendered to a standard user.

Step 3 — Payload / Execution Method: No injection payload or memory corruption is required. The "payload" is simply a series of well-formed API requests or UI navigation paths that solicit the Comply data collections. Because CWE-200 with a low confidentiality impact is declared, the exposed data is likely only partially sensitive — for example, device hostnames, operating system build numbers, installed hotfix lists, or compliance pass/fail flags for the attacker's own low-privilege context — not bulk credentials or secrets across the fleet. The attacker enumerates accessible Comply views or iterates through asset IDs to maximize the leaked dataset.

Step 4 — Post-Exploitation Impact: The leaked compliance snapshot gives the attacker an accurate map of the environment's configuration state. Hostname lists and configuration settings feed directly into follow-on attacks: identifying unpatched endpoints (by correlating hotfix data with known CVEs), locating specific high-value systems (e.g., domain controllers by role tag), or learning security-control toggles (e.g., which endpoints have full-disk encryption or endpoint detection and response disabled). This reconnaissance can reduce the attacker's dwell time in the network and tailor further lateral movement — a classic "reconnaissance amplification" post-exploitation use case. Given the scope is Unchanged and confidentiality impact Low, the attacker cannot directly extract credentials or exfiltrate bulk sensitive customer data through this single flaw alone.

Impact Assessment

The primary risk of CVE-2026-87035 is environmental intelligence leakage within an enterprise that already runs Tanium Comply. Because Tanium is an endpoint management and visibility platform, its compliance module stores assessment-derived metadata about endpoints across the entire fleet. A low-privilege user who successfully exploits this vulnerability can read parts of that compliance posture — information the organization likely considers confidential internal security data.

Business Impact:

• Confidentiality breach: Low severity per the CVSS (C:L). The data leaked is not likely to include full secrets but rather configuration state and compliance posture, which is nonetheless sensitive from a security-operations standpoint.
• Regulatory risk: For organizations in regulated industries (PCI-DSS, HIPAA, SOX), compliance audit data may itself be governed. Leaking this data to unauthorized users can trigger audit or disclosure obligations.
• Operational impact: Knowledge of which endpoints are non-compliant with a given policy (e.g., missing critical patches) is a direct roadmap for an attacker. This shifts the residual risk posture of the entire environment, even though no direct integrity or availability impact occurs.

Affected Systems: All Tanium servers and endpoints where the Comply module is enabled. Because the affected version range is unprovided, it is safest to consider all deployments running Comply as potentially vulnerable until Tanium publishes version-specific guidance.

Blast Radius (CVSS-derived): Confined to the Tanium management domain (S:U). The attacker must already possess a valid low-privileged account — this is not an unauthenticated remote takeover. The practical exploit barrier is acquiring those credentials, which raises the real-world risk profile above the raw 4.3 score in environments with weak credential hygiene.

Detection Guidance

Because no specific exploit pattern, HTTP parameter, or code signature has been published, detection rules emphasize behavioral anomaly detection around low-privileged users accessing unusual volumes of configuration/compliance data, or unusual data retrieval patterns from the Comply API surface. Rules are deliberately generic to avoid false negatives, and may require tuning per-environment.

Sigma Rule

title: Tanium Comply Information Disclosure - Suspicious Bulk Data Access by Low-Privileged User
id: 9f0c6a1e-3d2f-4c5a-8b6d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2026-87035 by monitoring for low-privileged users performing anomalous bulk retrieval of compliance or configuration data from the Tanium Comply module.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-87035
author: Valtersit.com Threat Intel
date: 2026/06/01
logsource:
    category: application
    product: tanium
detection:
    selection_ml:
        EventType: QueryDatabase
        AppName: Tanium Comply
        UserPrivilege: Low
    selection_role:
        EventType: QueryData
        RoleName: Standard_User
    filter_known_good:
        Username|endswith:
            - 'svc_comply_check'        # Known service accounts authorized for such queries
    correlation:
        timeframe: 5m
        condition: selection_ml or selection_role
        group-by:
            - UserName
            - src_ip
        cardinality:
            field: QueryResult
            max: 1000
    condition: selection_ml or selection_role and not filter_known_good
falsepositives:
    - Legitimate automation that retrieves compliance reports under a shared service account
    - Break-glass or emergency access by administrators
level: medium
tags:
    - attack.t1213
    - attack.collection
    - cve.2026.87035

YARA Rule

rule CVE_2026_87035_Tanium_Comply_Exfil_Pattern {
    meta:
        author = "Valtersit.com Threat Intel"
        description = "Detects network or file artifacts suggestive of information disclosure from Tanium Comply related to CVE-2026-87035. Looks for HTTP response body patterns indicative of bulk compliance data dumps."
        date = "2026-06-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87035"
        cve = "CVE-2026-87035"
        severity = "medium"
    strings:
        $comply_p1 = "compliance_result" ascii nocase
        $comply_p2 = "baseline_compare" ascii nocase
        $comply_p3 = "asset_configuration_snapshot" ascii nocase
        $json_data = /\{"data":\s*\[\{"asset_id"/ ascii
        $bulk_array = /\"items\"\s*:\s*\[\s*\{[^\]]{5000}/ ascii   // Large data arrays >5KB in single response
        $csd_meta = "check_id" ascii nocase
        $csd_std  = "cis_benchmark" ascii nocase
    condition:
        filesize > 200KB and
        ( 3 of ($comply_p*) or ($json_data and $bulk_array) or ($csd_meta and $csd_std) )
}

Suricata IDS Rule

alert http any any -> $TANIUM_SERVERS any (msg:"CVE-2026-87035 - Tanium Comply Potential Info Disclosure - Oversized Response to Low Priv User"; flow:established,to_server; content:"GET"; http_method; content:"/api/"; http_uri; content:"comply"; http_uri; content:"Compliance"; http_uri; http.response_body; length:100000; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-recon; sid:2026870351; rev:1; metadata:created_at 2026_06_01, updated_at 2026_06_01, cve 2026-87035;)

Elastic Detection

// Detect low-privilege users accessing bulk compliance data in a short window
sequence by user.name with maxspan=5m
  [authentication where host.name == "tanium-console-*" and outcome == "success"]
  [network where destination.port in (17472) and
     network.protocol == "http" and
     http.request.method == "GET" and
     url.path like "*comply*"]
  [network where destination.port in (17472) and
     network.protocol == "http" and
     http.response.bytes > 100000]     // Large data response

Splunk SPL Query

index=proxy OR index=network sourcetype="access_combined_wcookie" 
| where like(action, "GET") AND like(url_path, "%comply%")
| where user_role="standard_user" OR user_priv="low"
| eval response_size = bytes
| stats count as requests, max(response_size) as max_response_size, distinct_count(url_path) as unique_paths by user, clientip
| where requests > 20 AND max_response_size > 500000
| table _time, user, clientip, requests, max_response_size, unique_paths
| sort - max_response_size

Wazuh OSSEC Rule

<group name="tanium,comply,information_disclosure,">
  <rule id="100801" level="8">
    <decoded_as>json</decoded_as>
    <field name="event_type">^audit$</field>
    <field name="app_name">^Comply$</field>
    <field name="user_privilege">^(standard|low)$</field>
    <description>CVE-2026-87035: Low-privileged user accessed Tanium Comply dataset with bulk data retrieval pattern. Mitigate per vendor guidance.</description>
    <group>cve_2026_87035,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status: Patch confidence is 0/4 — UNPATCHED. No patch evidence has been identified from any tracked source. The vendor advisory was NOT published and no fixed version is referenced in the CVE record. The CVE description uses "addressed," suggesting Tanium may be working on an internal fix, but that change has not been publicly attributed to a specific release.

Immediate Mitigations:

1. Audit low-privileged accounts: Review all non-administrative accounts in the Tanium console. Revoke any account whose role definition includes access to compliance/assessment data but whose job function does not require it. Implement the principle of least privilege.
2. Restrict network exposure: If the Comply module's API/console is not required to be accessible from the entire corporate network, place it behind a firewall allowlist or VPN. Limit access to the specific IP ranges of security-administration workstations.
3. Harden the management plane: Enforce multi-factor authentication for all console access, including low-privileged accounts, to reduce the risk of credential compromise that would allow exploitation of this flaw.
4. Monitor API/console access: Apply the detection rules above to your SIEM/IDS stack to log and alert on anomalous data retrieval patterns from low-privileged users.

Patch / Upgrade Steps:

1. Monitor Tanium release notes (https://community.tanium.com) for any announcement referencing CVE-2026-87035.
2. Refer to the vendor advisory once published, and schedule an upgrade of the Comply module to the first patched release.
3. Until then, treat all current Comply releases as potentially vulnerable. There is no version-specific safe harbor.

Long-Term Hardening:

1. Segment management infrastructure: Place Tanium servers and the Comply module in a dedicated management VLAN with strict egress/ingress rules, reducing the passive reconnaissance value of any future disclosure.
2. Role-based access control (RBAC) review cadence: Conduct quarterly reviews of Tanium role assignments. Remove standing "Compliance Viewer" access for operational users; provide time-limited access through a break-glass or approval workflow.
3. Adopt a zero-trust access model for the console plane: require per-session reauthentication and continuously validate the user's risk profile.
4. Verify the integrity of compliance data export: Add change detection for the Comply configuration database to spot unauthorized modifications that could suppress or alter assessment output (defense-in-depth against post-exploitation lateral actions).

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-87035 (CVE record; source of CVSS score and description)
2. Tanium Community / Security Advisories — https://community.tanium.com (Monitor for official advisory addressing CVE-2026-87035; none published at time of this report)
3. CWE-200 Entry — https://cwe.mitre.org/data/definitions/200.html (Vulnerability class reference for "Exposure of Sensitive Information to an Unauthorized Actor")
4. MITRE ATT&CK — T1213 — https://attack.mitre.org/techniques/T1213/ (Data from Information Repositories — aligns with the post-exploitation intent of the disclosed data)
5. CVSS v3.1 Specification — https://www.first.org/cvss/v3.1/specification-document (Vector interpretation context)

Threat Actor Activity / Exploit-in-the-Wild Evidence: No known campaigns, exploit code, or CISA KEV listing exist for this CVE at the time of writing. The vulnerability is not known to be exploited in the wild. Monitoring for Tanium-specific threat actor activity should continue, as enterprise management-plane vulnerabilities historically attract interest from sophisticated intrusion sets once technical details are published.