CVE-2026-87037

Executive Summary

CVE-2026-87037 is an improper access control vulnerability (CWE-862, "Missing Authorization") in Tanium Comply, Tanium's endpoint compliance and vulnerability assessment module. The flaw is remotely exploitable over the network by an authenticated, low-privileged user (CVSS 3.1 base score 5.4, vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), allowing that user to reach functionality or data they should not be authorized to access. Because the vulnerability requires only a valid low-privilege account and no user interaction, it is primarily a privilege-boundary erosion issue: a "comply" or reporting-tier operator could potentially perform actions or read content reserved for administrative roles. No public proof-of-concept, Nuclei template, or exploit code exists, CISA KEV does not list the CVE, and the EPSS score is 0.00138 (3.5th percentile), indicating that exploitation in the wild is currently assessed as unlikely. Impact is bounded to partial confidentiality and integrity loss; there is no availability impact and no scope change.

Technical Analysis

The vulnerability class is CWE-862: Missing Authorization. This weakness describes a condition in which a software component fails to perform an authorization check before granting access to a resource or operation. In practical terms, the application authenticates the request but does not verify that the requesting principal holds the privilege required for the requested action.

The CVSS vector tells us precisely how to characterize the flaw, and nothing more:

• AV:N (Network) — the vulnerable component is reachable over a network path; the attacker does not require local or adjacent access.
• AC:L (Low) — no unusual race condition or specialized precondition beyond a valid account is needed.
• PR:L (Low privileges) — the attacker must possess some valid credentials, but those credentials need not be administrative. This is the defining property: the check that is performed is authentication; the check that is missing is authorization.
• UI:N (None) — no victim must click, approve, or otherwise participate. The attacker acts autonomously with their own low-privileged session.
• S:U (Unchanged) — exploitation does not let the attacker pivot the security authority of the vulnerable component into another component.
• C:L / I:L (Low Confidentiality / Low Integrity) — the attacker gains partial, bounded read access and partial, bounded write/modify capability within the Comply application scope. Impact is not total compromise of the data set.
• A:N (None) — no availability impact is registered.

Attack surface. Tanium Comply is a compliance-scanning and reporting module operating within the Tanium platform, which is a client-server endpoint management architecture (Tanium Clients on managed endpoints communicating with Tanium Servers and module services). The authorization boundary at issue is the enforcement point on the Comply-facing service(s) that process requests from platform users. Because the request is authenticated but not authorized, the defect is best understood as an object- or function-level access control gap: the service processes an operation for a low-privilege principal that role-based policy should have denied.

Code-level detail is not available in the supplied intelligence. The NVD description states only that Tanium "addressed an improper access controls vulnerability in Comply." No endpoint paths, parameter names, role identifiers, API verbs, or handler names are provided, and none are fabricated here. Any statement naming specific routes or functions would be speculation and is deliberately excluded.

Why this class matters in an endpoint-management product. Tanium deployments are highly privileged by design — the platform touches nearly every managed endpoint and often carries sensitive compliance and vulnerability data (findings, asset inventories, configuration state). An authorization bypass within a Comply-facing function can therefore expose or alter compliance posture data that informs remediation decisions, and in some deployments can interact with data flows that feed other modules. The CVSS confidentiality and integrity ratings (both Low) bound this, but the strategic value of compliance data in a managed estate is high relative to its direct sensitivity.

Exploitation Scenarios

No public proof-of-concept is available; the chain below is inferred strictly from the vulnerability class (CWE-862) and the CVSS vector. It describes the attack pattern at the class level and does not assert specific endpoints, parameters, or handler names, none of which are present in the source data.

1. Reconnaissance / target identification. An attacker who has obtained or been issued a legitimate low-privilege account on a Tanium platform instance surveys which module services are reachable through the platform's network interface. Public exposure of Tanium services is enumerable via internet-wide scanners (see Shodan dorks above); in many breaches, however, the foothold is an insider or a compromised contractor account with limited permissions. The attacker maps which Comply-related operations their session can invoke and observes which succeed versus which return authorization errors — the difference reveals the missing check.

2. Triggering the flaw. Using their authenticated, low-privilege session, the attacker issues a request to a Comply-facing operation that is normally reserved for a higher role. Because the service authenticates the session but does not evaluate the caller's role before processing the request, the operation is carried out. No crafted payload, memory corruption, or injection is required: the request is well-formed and the session is valid. This is the essential property of CWE-862 — the attacker supplies authorization the application failed to demand, not malformed input.

3. Execution method. At the vulnerability-class level, the attacker simply invokes the privileged function or accesses the protected resource through the normal request mechanism (e.g., a platform API call or Comply UI action), relying on their low-privilege token. The absence of a UI:N interaction requirement confirms the request executes server-side on the attacker's initiative alone. No specific endpoint or parameter syntax is asserted here because none is documented in the source data.

4. Post-exploitation impact. Successful exploitation grants the low-privileged principal partial access to Comply data or operations beyond their authorization — consistent with the CVSS C:L/I:L ratings. This could mean reading compliance-scan results, posture findings, or asset state not intended for that role (confidentiality), or making bounded modifications to compliance-related records (integrity). There is no availability effect (A:N) and no extension of the vulnerable component's authority to other components (S:U). The realistic outcome is data exposure and integrity erosion within the compliance scope, not full platform takeover.

Two enabling conditions warrant emphasis: (a) the attacker must already hold a valid account, which lowers the bar for insiders and post-phishing actors; and (b) low complexity and no user interaction mean that once the gap is identified, exploitation is reliable and repeatable.

Impact Assessment

Business impact. CVE-2026-87037 erodes the role separation that customers rely on when delegating Tanium Comply access to operators, auditors, or third parties. In regulated environments, unauthorized access to compliance data can undermine audit integrity and, if the exposed data contains sensitive asset or configuration detail, constitute a reportable confidentiality event. Partial integrity impact means records underlying compliance posture could be altered by an actor who should only have read or none at all — a serious concern where compliance evidence is used for attestation.

Affected systems. Organizations running Tanium Comply within their Tanium deployment and extending platform access to non-administrative users. The absence of a supplied affected-version range means defenders must consult the vendor's release notes to scope exposure precisely.

Blast radius. Bounded by S:U (no scope change) and C:L/I:L (partial impact only). The vulnerability does not provide code execution, lateral movement, or availability loss on its own. However, Tanium's privileged position on managed endpoints means compliance data is often high-value and widely consumed, so the same stolen information can support secondary targeting (e.g., choosing which systems to attack because they are known to be unpatched).

CVSS subscores recap. AV:N, AC:L, PR:L, UI:N, S:U, C:L, I:L, A:N → 5.4 (Medium). The Medium rating reflects the authentication prerequisite and the partial nature of the confidentiality/integrity impact rather than any technical difficulty in exploiting the flaw once an account is held.

Exploitation likelihood. Low. EPSS 0.00138 (3.5th percentile) indicates negligible predicted exploitation activity over the next 30 days; there is no public PoC, no Nuclei template, no observed exploit code, and CISA KEV does not list the CVE. This is a "patch when ready, detect on the way" vulnerability, not an emergency.

Detection Guidance

Detection for an authorization-bypass class vulnerability is inherently behavioral: because requests are well-formed and authenticated, signatures cannot key on malformed payloads. The rules below focus on low-privileged users reaching privileged Comply operations — anomalous audit-log patterns and network-level access to Comply service endpoints from unexpected principals. Because no endpoint paths are documented, the rules use generic Tanium/Comply identifiers and require local tuning.

Sigma Rule

title: Potential Tanium Comply Authorization Bypass - Low-Privilege User Accesses Privileged Operation
id: 6f3a9c2e-8703-4b1e-9a44-000087037001
status: experimental
description: Detects a low-privileged Tanium account invoking Comply operations normally
  reserved for administrative roles, consistent with CWE-862 missing authorization
  (CVE-2026-87037). Requires environment-specific tuning of role/operation names.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87037
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: tanium
  service: audit
detection:
  selection_module:
    event.action|contains:
      - 'comply'
  selection_denied_role:
    tanium.user.role|contains:
      - 'read-only'
      - 'operator'
      - 'auditor'
      - 'report'
  selection_privileged_op:
    event.action|contains:
      - 'comply.export'
      - 'comply.modify'
      - 'comply.config'
      - 'comply.policy'
  condition: selection_module and selection_denied_role and selection_privileged_op
falsepositives:
  - Legitimate role changes that have not yet propagated to cached sessions
  - Administrative accounts whose role string contains a tuned keyword
level: medium
tags:
  - attack.t1078
  - cve.2026.87037

YARA Rule

rule CVE_2026_87037_Tanium_Comply_Authz_Bypass_Artifacts
{
    meta:
        description = "Hunts for request/response artifacts indicative of Tanium Comply authorization-bypass probing (CVE-2026-87037)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87037"
        date = "2026-01-01"
        cve = "CVE-2026-87037"

    strings:
        $a1 = "Tanium Comply" ascii nocase
        $a2 = "/comply/" ascii nocase
        $b1 = "403" ascii
        $b2 = "401" ascii
        $c1 = "role" ascii nocase
        $c2 = "authorization" ascii nocase
        $d1 = "denied" ascii nocase
        $d2 = "forbidden" ascii nocase

    condition:
        (uint16(0) == 0x0A0D or uint32(0) == 0x504B0304 or true) and
        $a1 and $a2 and
        (2 of ($b*)) and
        (1 of ($c*)) and
        (1 of ($d*))
}

Note: The YARA rule above is a heuristic artifact hunt — it targets request/response captures and log extracts referencing the Comply module alongside authorization-denial tokens. It is not a memory scanner signature for the vulnerability itself; no such memory artifacts are documented.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87037 Possible Tanium Comply Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"comply"; nocase; http.uri; pcre:"/comply[^\r\n]*(export|config|policy|modify)/i"; http.user_agent; content:"Tanium"; nocase; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-user; reference:cve,2026-87037; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87037; sid:8703701; rev:1;)

Tuning guidance: narrow the http.uri PCRE to your actual Comply API path prefix once the vendor publishes it. The rule intentionally keys on the combination of the Comply module path segment and privileged-operation keywords so that ordinary read traffic does not fire it.

Elastic Detection

sequence by user.name, source.ip with maxspan=60s
  [authentication where event.outcome == "success" and user.roles : ("read-only" or "operator" or "auditor")]
  [http where url.path : "*comply*" and http.request.method in ("POST", "PUT", "DELETE", "PATCH") and event.outcome in ("success", "unknown")]

This sequence catches the canonical CWE-862 pattern: a low-privileged principal authenticates, then within a minute issues a state-changing request against a Comply operation. Success (or an unknown/ambiguous outcome from a service that does not log authorization outcomes) is the signal. Tune user.roles and url.path to your schema.

Splunk SPL Query

index=tanium sourcetype IN ("tanium:audit","tanium:comply")
| eval role=lower(coalesce(tanium_user_role, user_role, role))
| search role IN ("read-only","operator","auditor","report") 
    (uri="*comply*" OR action="*comply*")
    (method IN ("POST","PUT","DELETE","PATCH") OR action IN ("comply.export","comply.modify","comply.config","comply.policy"))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as targets by user, src_ip, role
| where count >= 3
| convert ctime(first_seen) ctime(last_seen)
| table user, src_ip, role, count, targets, first_seen, last_seen

Wazuh OSSEC Rule

<group name="tanium,comply,access_control,">
  <rule id="870370" level="8">
    <decoded_as>json</decoded_as>
    <field name="product">Tanium</field>
    <field name="module">Comply</field>
    <field name="user_role">read-only|operator|auditor|report</field>
    <field name="http_method">POST|PUT|DELETE|PATCH</field>
    <description>CVE-2026-87037: Low-privilege Tanium user performed state-changing Comply operation (possible authorization bypass)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_87037,</group>
  </rule>

  <rule id="870371" level="10" frequency="5" timeframe="120">
    <if_matched_sid>870370</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-87037: Repeated low-privilege Comply operations from same source (active exploitation attempt)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A patch is asserted by a single source (NVD) and has not been independently confirmed. No vendor advisory reference, patched version string, or affected version range accompanied the data. The "Vendor Fix" and "Workarounds" fields are N/A. Treat remediation as unverified until confirmed against Tanium's official release notes and security advisories.

1) Immediate mitigations (apply now, before patch verification):

• Restrict who holds accounts on the Tanium platform. The vulnerability requires a valid low-privilege account (PR:L). Reduce the population of Comply-accessible accounts to the minimum operational set, and deprovision dormant or contractor accounts promptly.
• Network-segment the Tanium server/module services. Do not expose Tanium management or module interfaces to untrusted networks or the public internet. Behind a VPN or a zero-trust access proxy, the PR:L prerequisite becomes substantially harder to satisfy remotely.
• Enforce least privilege on roles. If the platform permits custom roles, ensure no role that has Comply read access also inherits state-changing Comply permissions. Audit existing role assignments for over-granted operator/auditor accounts.
• Increase audit logging and retention for Comply operations so that the detection rules above have data to act on, and so that any abuse during the patch window is reconstructable.

2) Patch / upgrade steps:

• Obtain the exact fixed release from Tanium's official release notes or support portal — the intelligence data provided does not include a patched version identifier, so do not assume a version number.
• Verify the patch covers CVE-2026-87037 explicitly; a "we addressed an improper access control" note should be cross-referenced to your deployed module version.
• Stage the upgrade in a non-production Tanium environment, confirm Comply functionality and role enforcement post-upgrade, then roll out. Because the fix likely enforces authorization on a previously unguarded operation, validate that legitimate administrative workflows still function.
• Confirm with the vendor (or an independent check) whether the fix is a full authorization control or a partial hardening, given the 2/4 patch-confidence rating.

3) Long-term hardening:

• Authorization testing in SDLC. CWE-862 recurs when authorization is enforced at the UI layer but not at the service layer. Require server-side, deny-by-default authorization checks for every privileged operation, with automated tests that exercise low-privilege principals against high-privilege endpoints.
• Role-based access reviews at a recurring cadence for the Tanium platform, with explicit mapping of role → permitted operations in Comply.
• Behavioral monitoring as a standing control. Authorization-bypass flaws are quiet by nature; keep the low-privilege-to-privileged-operation detection patterns (Sigma/Elastic/Splunk) enabled permanently, not just during this CVE's patch window.
• Track EPSS and KEV. EPSS is currently 0.00138 and the CVE is not in KEV. Reassess priority if either changes or if a public PoC emerges.
• Subscribe to Tanium security advisories so that the CLAIMED patch can be upgraded to CONFIRMED with a specific version and affected range.

References

1. NVD — CVE-2026-87037: https://nvd.nist.gov/vuln/detail/CVE-2026-87037 — primary record; source of the NVD description, CVSS 5.4 vector, CWE-862 mapping, and the single-source patch claim.
2. MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html — authoritative definition of the weakness class used throughout this report.
3. FIRST EPSS: https://www.first.org/epss/ — EPSS 0.00138 (3.5th percentile); recompute at time of triage as scores drift.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-87037 is not listed as of this report; recheck periodically.
5. Tanium Security Advisories / Release Notes: https://security.tanium.com/ (vendor security advisory portal) — consult directly to obtain the affected version range, the fixed version, and confirmation of the patch claim; none were provided in the source intelligence.

Threat actor / in-the-wild note: No exploit code, Nuclei template, or public PoC exists for CVE-2026-87037, and there is no evidence of exploitation in the wild as of this writing. No threat-actor campaign has been attributed. The attack chain described in the Exploitation Scenarios section is inferred solely from the CWE-862 class and the CVSS vector, and should be treated as a defensive model rather than a confirmed adversary playbook.