CVE-2026-87036

Executive Summary

CVE-2026-87036 is an improper access control vulnerability (CWE-862, Missing Authorization) in Tanium Comply, the compliance assessment and vulnerability-management module of the Tanium endpoint management platform. The flaw carries a CVSS 3.1 base score of 8.1 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, meaning an authenticated low-privileged attacker with network reach to the affected interface can bypass intended authorization checks and achieve high impact to both data integrity and availability, while confidentiality is assessed as unaffected. No public proof-of-concept, exploit code, or Nuclei template exists, CISA KEV does not list the CVE, and the EPSS score is negligible (0.00210, 11.4th percentile) — indicating no observed exploitation activity in the wild at time of writing.

Technical Analysis

The root cause is classified as CWE-862, "Missing Authorization." This weakness class describes a product that does not perform an authorization check when a user attempts to access a resource or perform an action, effectively allowing access that the intended security policy would deny. In the context of Tanium Comply, this means an authenticated principal that holds only low privileges (reflected in the PR:L vector component) is able to reach functionality or manipulate data that should be restricted to higher-privileged roles.

The CVSS vector provides the clearest signal about the mechanics:

• AV:N (Network) — the vulnerable surface is reachable remotely over the network, not limited to local console access. This is consistent with Tanium's client-server architecture, in which endpoints and console components communicate with Tanium Server over network transports.
• AC:L (Low complexity) — no unusual preconditions, race conditions, or specialized timing are required; exploitation is straightforward once an authenticated session exists.
• PR:L (Low privileges) — the attacker must already be authenticated with a low-privileged account. This distinguishes the flaw from an unauthenticated bypass and places it in the post-authentication attack category.
• UI:N (No user interaction) — the victim does not need to click, confirm, or otherwise participate.
• S:U (Scope Unchanged) — the impact remains within the same security authority; the vulnerable component does not grant control over a distinct security context.
• C:N (Confidentiality: None) — critically, the attack path does not expose sensitive data. The flaw does not allow reading information that would otherwise be protected.
• I:H (Integrity: High) — the attacker can modify data or configuration with a high degree of impact. Within a compliance and vulnerability-management product, this would include the ability to alter compliance scan definitions, policy configurations, or assessment results.
• A:H (Availability: High) — the attacker can render resources unavailable, degrade performance, or interrupt service. Against a compliance engine, this could mean disabling or disrupting scanning functionality.

Taken together, the vector describes an authenticated low-privileged user who, through a missing authorization check, can tamper with and disrupt Tanium Comply functionality — but cannot read protected data. The precise endpoint, API route, parameter, or method name involved is not disclosed in the NVD description or CNA title. No function names, URLs, or code paths are available in the supplied intelligence. This report therefore analyzes the vulnerability at the class level and does not fabricate implementation specifics.

It is worth emphasizing what is not known. The NVD description is a single sentence: "Tanium addressed an improper access controls vulnerability in Comply." It does not identify the affected version range, the specific role or permission boundary that is broken, the interface (console UI, REST API, or endpoint client communication), or the fixed release. The affected-versions list is empty in the supplied data. Any reader should treat version-impact claims from third parties with caution until Tanium publishes a formal advisory (typically via their security advisory portal and Tanium Community release notes).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-862 Missing Authorization) and the CVSS vector. No specific function names, endpoints, or parameters are invented, because none are present in the source data.

Phase 1 — Reconnaissance and target identification. An adversary with network reach to a Tanium environment identifies a reachable Tanium Server or Comply API endpoint. Because the CVE requires authentication, the attacker must first obtain valid low-privileged credentials. Realistic acquisition paths include: abuse of shared or default service accounts, credential reuse from unrelated breaches, purchase of credentials from initial-access brokers, phishing, or insider access. Scanning activity (Shodan/Censys queries for Tanium-facing interfaces) can identify exposed instances, but the exploitation step itself still requires a session.

Phase 2 — Triggering the Missing Authorization flaw. With an authenticated low-privileged session established, the attacker invokes Comply functionality that should require elevated privileges. Because the authorization check is absent (CWE-862), the request is processed rather than rejected. At the class level, this manifests as a direct request — over the network transport — to an operation the attacker should be forbidden from performing, and the server honors it. The specific request format, verb, path, and required headers are not published.

Phase 3 — Action / execution. Unlike injection-class or memory-corruption flaws, no payload delivery mechanism (shellcode, crafted file, deserialized object) is involved. The "payload" is simply the unauthorized request itself. Exploitation consists of performing privileged actions using an unprivileged account. Given I:H and A:H, plausible actions include modifying or deleting compliance policy/assessment data and disrupting Comply services — though the exact operations cannot be confirmed from available data.

Phase 4 — Post-exploitation impact. Because Scope is Unchanged and Confidentiality impact is None, the attacker gains no lateral privilege escalation into a distinct security context and exfiltrates no protected data through this flaw alone. The realized impact is integrity and availability degradation: falsified or destroyed compliance records could mask non-compliant endpoints, alter audit evidence, and undermine the reliability of an organization's compliance and vulnerability posture. Availability impact could interrupt scanning and reporting. Post-exploitation, an attacker may pivot to other techniques (T1078 Valid Accounts) to expand access using the same credential set.

Impact Assessment

Business impact. Tanium Comply is used by enterprises to assess configuration compliance and manage vulnerability findings across large endpoint estates. Corruption or suppression of this data directly undermines regulatory and audit assurances (CIS, DISA STIG, PCI DSS, HIPAA, and internal governance frameworks are commonly mapped in such tools). An attacker who can silently alter compliance state can hide unpatched or misconfigured systems from oversight — a high-integrity impact that may not surface until a subsequent audit or incident.

Affected systems. Any deploy of Tanium Comply at a version vulnerable to this flaw and reachable by an authenticated low-privileged account. The exact version range is unknown from the supplied data.

Blast radius. Constrained by PR:L (requires an account) and S:U (no scope change), but amplified by the fact that compliance tooling is a high-value control plane: a compromised or tampered compliance dataset affects every endpoint the tool governs. Multi-tenant or large-estate deployments face proportionally larger downstream effect.

CVSS subscores at a glance. Base 8.1 / High. Exploitability is moderate-to-high (AV:N, AC:L, PR:L, UI:N), while impact is asymmetric: confidentiality None, but integrity and availability both High. This profile is characteristic of a tamper/disruption vulnerability rather than a data-breach vector.

Detection Guidance

Detection for a missing-authorization flaw is inherently difficult at the network signature level because the malicious request may be syntactically identical to a legitimate high-privileged one. The strongest signals come from authorization anomaly correlation: a low-privileged identity performing privileged Comply operations, or Comply configuration/assessment mutations originating from unexpected accounts or hosts. The rules below are heuristic and must be tuned to your actual log schema (Tanium audit logs, reverse-proxy/API gateway logs, SIEM field names). Field names such as user.role, event.action, and url.path are illustrative mappings, not guarantees.

Sigma Rule

title: Potential Tanium Comply Authorization Bypass (CVE-2026-87036)
id: 8b9f2c14-3a7e-4d61-9c2b-0f5e1a7d4c88
status: experimental
description: Detects low-privileged or unexpected accounts performing privileged Tanium Comply operations, consistent with CWE-862 missing authorization abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87036
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.t1078
  - cve.2026.87036
logsource:
  product: tanium
  service: comply
detection:
  selection_action:
    event.action|contains:
      - 'comply.config'
      - 'comply.policy'
      - 'comply.assessment'
      - 'comply.scan'
  selection_privileged:
    user.role|contains:
      - 'operator'
      - 'read_only'
      - 'unprivileged'
  selection_mutation:
    event.outcome: 'success'
  condition: selection_action and selection_privileged and selection_mutation
falsepositives:
  - Legitimate role changes or delegated administration
  - Service accounts with overlapping naming conventions
level: high

YARA Rule

rule CVE_2026_87036_Tanium_Comply_Authz_Indicators
{
    meta:
        description = "Heuristic detection for artifacts referencing CVE-2026-87036 / Tanium Comply authorization bypass in logs or captured traffic"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87036"
        date = "2026-01-01"
        cve = "CVE-2026-87036"

    strings:
        $cve = "CVE-2026-87036" ascii wide nocase
        $p1  = "Tanium Comply" ascii wide nocase
        $p2  = "tanium" ascii wide nocase
        $a1  = "Missing Authorization" ascii wide nocase
        $a2  = "CWE-862" ascii nocase
        $e1  = "authorization bypass" ascii wide nocase
        $e2  = "improper access control" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or
        ($p2 and 1 of ($a1, $a2, $e1, $e2)) or
        $cve
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87036 Possible Tanium Comply Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Tanium"; nocase; http.uri; content:"comply"; nocase; http.uri; content:"config"; nocase; classtype:attempted-admin; reference:cve,2026-87036; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87036; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202687036; rev:1;)

Elastic Detection

sequence by user.name with maxspan=2m
  [ authentication where user.roles : ("read_only" or "operator" or "unprivileged") ]
  [ network where url.path : "*comply*" and http.request.method : ("POST" or "PUT" or "PATCH" or "DELETE") ]

Splunk SPL Query

index=tanium sourcetype=tanium:comply OR sourcetype=tanium:audit
(event.action="comply.config.change" OR event.action="comply.policy.modify" OR event.action="comply.policy.delete" OR event.action="comply.assessment.update")
| eval risky=if(match(lower(user.role),"(read_only|operator|unprivileged|viewer)"),1,0)
| where risky=1
| stats count min(_time) as first_seen max(_time) as last_seen values(event.action) as actions by user.name, src_ip, user.role
| where count > 0
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="tanium,comply,cve-2026-87036,">
  <rule id="2026870" level="10">
    <decoded_as>json</decoded_as>
    <field name="product">Tanium</field>
    <field name="service">Comply</field>
    <field name="event.action">\.*(config|policy|assessment)\.*(change|modify|delete|update)$</field>
    <field name="user.role">\.*(read_only|operator|unprivileged|viewer)$</field>
    <description>CVE-2026-87036: Possible Tanium Comply authorization bypass - low-privileged account performed privileged operation</description>
    <mitre>
      <id>T1190</id>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). The only patch evidence is an NVD description stating "Tanium addressed an improper access controls vulnerability in Comply." No fixed version, advisory ID, or release note is supplied.

1. Immediate mitigations.

   • Restrict network access to Tanium Server and Comply interfaces to trusted management VLANs, VPN, or zero-trust proxies. Do not expose Tanium management ports to the internet.
   • Audit and minimize low-privileged accounts; enforce least privilege and remove shared/standing service accounts where possible.
   • Enable and centralize Tanium audit logging into the SIEM; alert on low-privileged roles performing configuration, policy, or assessment mutations.
   • Take a known-good backup/snapshot of Comply configuration and assessment data to support integrity restoration.

2. Patch / upgrade steps.

   • Contact Tanium support or consult the official Tanium security advisories portal and Tanium Community release notes to obtain the fixed Comply version, since it is not published in the supplied data.
   • Do not assume a fix is available on your current train; verify the fixed release against an authoritative Tanium source before declaring remediation complete.
   • Stage the upgrade in a non-production environment, confirm the authorization behavior is corrected, then roll out.

3. Long-term hardening.

   • Implement server-side authorization checks for every privileged Comply operation (the missing control at the heart of CWE-862), and adopt deny-by-default policy for sensitive actions.
   • Maintain role-based access control reviews and periodic entitlement audits.
   • Monitor Tanium security bulletins as a standing subscription; treat compliance tooling as tier-0 control-plane infrastructure.

References

1. NVD — CVE-2026-87036: https://nvd.nist.gov/vuln/detail/CVE-2026-87036
2. MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
3. FIRST — CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
4. Tanium — Security Advisories (vendor advisory portal; consult for the fixed version): https://www.tanium.com/security
5. CISA Known Exploited Vulnerabilities Catalog (checked — CVE-2026-87036 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild: None identified. CISA KEV does not list this CVE, EPSS is 0.00210 (11.4th percentile), and there is no public PoC, exploit code, or Nuclei template. No attribution or campaign data is available. All exploitation analysis above is inferred from the CWE-862 vulnerability class and the CVSS vector.