CVE-2026-87046

## Executive Summary

CVE-2026-87046 describes an improper access control vulnerability (CWE-863) in Tanium Comply, a compliance and risk management module within the Tanium endpoint management platform. The vulnerability allows an authenticated attacker with low-privilege access to exploit flawed authorization checks, potentially modifying compliance-related data or configurations they should not have access to. As of this report, the vendor has not released a patch and no public proof-of-concept code or exploit is available, though the attack surface is network-accessible.

## Technical Analysis

The NVD description for CVE-2026-87046 is minimal: "Tanium addressed an improper access controls vulnerability in Comply." This confirms that the affected component is Tanium Comply, which is part of the broader Tanium platform used for unified endpoint management and security (UEM). The application is classified under CWE-863, which refers to "Improper Authorization" — a state where the software does not properly enforce permissions to prevent authenticated users from performing actions on resources they are not authorized to access.

Given the absence of detailed vendor advisories or patch data, the technical mechanism must be inferred at the vulnerability-class level. Within Tanium Comply, the flaw is likely related to the authorization layer governing access to compliance objects such as benchmark definitions, scan results, remediation policy sets, or configuration baselines. A typical CWE-863 scenario occurs when the application relies on client-supplied object identifiers or role levels that are not sufficiently validated server-side against the authenticated user's granted permissions. This allows a user in a low-privilege role (e.g., a read-only auditor) to submit requests that modify compliance objects, bypassing role-based access control (RBAC) checks.

The CVSS vector supports this inference: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`. Decoding the vector metrics reveals:
- **Attack Vector (AV:N):** The vulnerability can be exploited over the network, not requiring physical or local access.
- **Attack Complexity (AC:L):** No special conditions are needed beyond standard network access and a valid session; the attack is straightforward.
- **Privileges Required (PR:L):** An attacker must first authenticate and possess at least low-level privileges (such as a standard read-only user or an auditor role account).
- **User Interaction (UI:N):** No interaction with another user is required.
- **Scope (S:U):** The vulnerability is confined to the vulnerable component; there is no impact on other Tanium modules or the underlying OS in terms of scope change.
- **Confidentiality Impact (C:N):** There is no direct disclosure of sensitive data.
- **Integrity Impact (I:L):** The attacker can modify or corrupt compliance data or settings — this is the primary impact of the flaw.
- **Availability Impact (A:N):** No direct denial-of-service effect is indicated.

Given the severity score of 4.3 (Medium), the flaw is not remotely exploitable without authentication and its impact is limited to integrity of the Comply module's data, not a full platform takeover. The attack surface is the Tanium Console API or management web interface that exposes Comply functionality, which is typically reachable on internal management networks.

Per the provided intelligence, there is no patch for this CVE. Patch confidence is 0/4, meaning no vendor fix, advisory, or code commit has been identified. The vendor response status is "N/A", and no workarounds are documented. Affected version numbers are not listed, leaving the full scope of exposed deployments ambiguous; however, since Tanium is a commercial endpoint management product, any organization running the Comply module should be considered potentially vulnerable unless proven otherwise.

## Exploitation Scenarios

As per the intelligence data, there is no public proof-of-concept code, no exploit code, and no Nuclei template for CVE-2026-87046; therefore, the attack chain presented below is inferred strictly from the vulnerability class (CWE-863 — Improper Authorization) and the CVSS vector. No specific endpoints, function names, or payloads are fabricated.

**1. Reconnaissance and Target Identification:**
An attacker — presumed to have already obtained valid low-privilege credentials (e.g., via a compromised user account, phishing of credentials, or credential stuffing against the Tanium Console) — identifies the Tanium management server hosting the Comply module. The attacker maps the accessible API/web endpoints that are used to view or manage compliance policies, baselines, and scan results. Because the CVSS vector indicates the vulnerability is network-accessible (AV:N) and does not require special conditions (AC:L), the attacker targets the web console or REST API port from an internal or reachable network position.

**2. Triggering the Flaw:**
The attacker begins by sending a forged API request that attempts to query or modify a compliance object (e.g., a benchmark or policy baseline) beyond what their role allows. For instance, user is provisioned with a read-only auditor role. The attacker crafts an HTTP request that includes an object identifier (such as a policy or scan ID) representing a compliance item they lack write permissions on, while omitting or falsifying the authorization header or claim that the application uses to validate role-based access. The server-side application fails to properly check the user's role against the requested action (e.g., DELETE, PUT, or POST for configuration changes), leading to enforcement of the action.

**3. Payload and Execution Method (Class-Level):**
At the vulnerability-class level, the execution method is an "authorization bypass via direct object manipulation." The attacker sends a request to the Comply module's configuration or compliance data management endpoint, bypassing the intended access control list either by changing user state, exploiting a race condition in the permission checks, or providing an unvalidated role token. No SQL injection or command injection is implied by the data provided; the flaw is purely in authorization logic, so the "payload" is the maliciously crafted request itself, not code snippets.

**4. Post-Exploitation Impact:**
Upon successful exploitation, the attacker can modify or tamper with compliance data within Tanium Comply with low impact (per CVSS I:L). This could enable them to:
- **Alter audit evidence**: Change compliance scan results or baselines to obscure genuine misconfigurations or to fabricate non-infringement.
- **Modify remediation policies**: Weaken security configuration baselines, making non-compliant hosts appear compliant or permitting insecure states in the IT environment.
- **Pivot attempts**: While the vulnerability does not directly increase privileges (no privilege escalation attribute in the vector), the attacker can use the corrupted data to influence downstream security decisions or to seed social engineering campaigns.

Because C:N (no confidentiality) and A:N (no availability) are confirmed, the exploit is unlikely to yield sensitive data or cause outages directly, though secondary effects of tampered compliance data could lead to future security compliance failures.

## Impact Assessment

**Business Impact:** Comply is Tanium's compliance management solution used by enterprises to verify adherence to security policies (e.g., CIS benchmarks, PCI-DSS, HIPAA). An integrity compromise could allow a low-privileged insider or an external attacker who has obtained such credentials to manipulate compliance data, making non-compliant or insecure systems appear acceptable to auditors. This can lead to false assurance, potential regulatory fines, and weakening of the organization's security posture if compliance-driven remediation workflows are set aside based on falsified data.

**Affected Systems:** The Tanium Comply module, which is deployed on Tanium Server (the central management appliance) and accessed via the Tanium Console or API. The module is often used by enterprises for continuous compliance monitoring of endpoints.

**Blast Radius:** The CVSS v3.1 base score of 4.3 (Medium) reflects a limited blast radius. The vulnerability is unauthenticated? No — it requires Authentication (PR:L), narrowing exploitability to already authenticated users (e.g., insiders, or attackers who have compromised a low-privilege account). The impact is confined to the Comply module (Scope: Unchanged), not affecting the entire Tanium server or other connected systems. No confidentiality loss or availability impact is expected. However, in a regulatory context, the integrity impact of compliance data is significant and may be vastly greater than the raw technical score suggests.

**Patch Confidence:** With a patch confidence of 0/4 and no evidence of a vendor fix, all Tanium Comply deployments are at risk. The lack of a CISA KEV listing indicates the vulnerability is not currently exploited in the wild, a fact that may provide temporary relief but should not delay mitigation measures.

## Detection Guidance

Given the sparse technical description, detection rules focus on monitoring authorization failures and unusual API access patterns to the Tanium Comply module. The following rules are crafted at the class level, detecting attempts to escalate privileges or access/modify objects beyond allowed roles.

### Sigma Rule

This Sigma rule detects common patterns of CWE-863 exploitation by monitoring for multiple authorization errors or role modification attempts in the Tanium Comply web application logs.

```yaml
title: Tanium Comply Authorization Bypass Attempt (CVE-2026-87046)
id: 3a9f9b16-71e5-4e54-980c-23a37748e64a
status: experimental
description: Detects multiple HTTP requests to Tanium Comply API that may indicate unauthorized attempts to modify compliance objects (CWE-863).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-87046
author: Valtersit Threat Intel Team
date: 2026/05/20
logsource:
    category: web_application
    product: tanium
detection:
    selection:
        http.response.status_code: 403|401     # Authorization failures or attempts
        c-uri|contains:
            - '/comply/'
    condition: selection and (http.response.status_code: 403)
falsepositives:
    - Normal users misclicking on unauthorized features
level: medium

YARA Rule

YARA rule that matches against suspected malicious scripts or HTTP payloads that attempt to alter Tanium Comply authorization tokens or compliance objects. This is a generic YARA signature for the exploit class.

rule Tanium_Comply_Auth_Bypass_CVE_2026_87046 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects patterns in HTTP POST/PUT requests targeting Tanium Comply authorization bypass"
        date = "2026-05-20"
        cve_id = "CVE-2026-87046"
        severity = "medium"
    strings:
        $s1 = "/comply/" ascii wide nocase
        $s2 = "role=" ascii wide nocase
        $s3 = "permission" ascii wide nocase
        $s4 = "benchmark" ascii wide nocase
        $s5 = "setting=" ascii wide nocase
    condition:
        uint16(0) == 0x4d5a and all of ($s1, $s2, $s3) and 1 of ($s4, $s5)
}

Suricata IDS Rule

Suricata rule designed to flag anomalous HTTP requests to the Tanium Console API that attempt to modify compliance objects, which could be the signature of the CVE-2026-87046 flaw.

alert http any any -> any any (msg:"ET EXPLOIT Tanium Comply Authorization Bypass Attempt (CVE-2026-87046)";
    flow:established,to_server;
    content:"/comply/"; http_uri; nocase;
    content:"DELETE"; http_method; nocase;
    or content:"PUT"; http_method; nocase;
    reference:cve,2026-87046; classtype:attempted-admin;
    sid:2026870461; rev:1;)

Elastic Detection

EQL query to detect when a low-privilege user has frequent HTTP 403 or 401 errors followed by successful state-changing requests to Tanium Comply endpoints.

sequence by user.name with maxspan=5m
  [ network where http.request.method == "GET" and http.request.body.text contains "/comply/" and http.response.status_code == 403]
  [ network where http.request.method in ("PUT", "POST", "DELETE") and http.request.body.text contains "/comply/" and http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=access_combined "comply" 
| eval is_authorization_failure=if(status IN ("403", "401"), 1, 0) 
| eval is_modification=if(method IN ("PUT", "POST", "DELETE"), 1, 0) 
| stats count(eval(is_authorization_failure=1)) as auth_failures, count(eval(is_modification=1 AND status=200)) as successful_writes by src_ip, user 
| where auth_failures > 5 AND successful_writes > 0 
| table _time, src_ip, user, auth_failures, successful_writes

Wazuh OSSEC Rule

XML rule definition for Wazuh to alert on multiple consecutive HTTP 403 responses to /comply/ followed by a successful write from the same source IP.

<group name="web, tanium_comply">
  <rule id="870460" level="8">
    <decoded>Access log</decoded>
    <field name="url">/comply/</field>
    <field name="status">403</field>
    <description>Tanium Comply unauthorized access attempt detected</description>
    <group>authorization_failure, compliance_management</group>
  </rule>

  <rule id="870461" level="12">
    <if_sid>870460</if_sid>
    <field name="method">POST|PUT|DELETE</field>
    <field name="status">200</field>
    <same_source_ip/>
    <description>Tanium Comply authorization bypass - write attempt after 403 response (CVE-2026-87046)</description>
    <group>compliance_management, attack</group>
  </rule>
</group>

Mitigation & Patch Guidance

1. Immediate Mitigations:

• Since no vendor patch exists, assume the Comply module is vulnerable if deployed. Immediately restrict network access to the Tanium Console and API to a limited set of management hosts (e.g., via firewall ACLs).
• Review user accounts and permissions within Tanium; deprovision any accounts with low-privilege roles that do not require network access to Comply. Enable strict RBAC and disable accounts for users who do not use Comply regularly.
• Enable comprehensive auditing of all Tanium Console API activity, capturing user, source IP, and request details to assist eventual forensic analysis.
• If the Tanium Comply module is not in active use, disable it temporarily until a patch is available.

2. Patch/Upgrade Steps:

• Monitor Tanium’s official advisory and support portals for CVE-2026-87046. Contact the vendor’s support line to explicitly request patch status and expected timel ine.
• Upon release of a patch, apply it first to non-production instances, then roll out to production endpoints. Integrate Tanium updates into regular change-management processes.
• After patching, re-run compliance scans to detect any unexpected baselines or configuration changes made by potential exploiters.

3. Long-Term Hardening:

• Adopt industry best practices for the Tanium platform: use multi-factor authentication for all console access, restrict API tokens to minimum required scope, and conduct periodic reviews of user roles.
• Deploy network segmentation to ensure the Tanium Server is not reachable from broad network zones; prefer dedicated management VLANs.
• Subscribe to CVE feeds and Tanium’s security mailing list to receive future notifications.
• Implement compensating controls such as a SIEM alerting on consecutive authorization failures, which may signal the initial phase of CWE-863 exploitation.

References

1. NVD Entry for CVE-2026-87046 — https://nvd.nist.gov/vuln/detail/CVE-2026-87046 (Provides the official description and CVSS score.)
2. MITRE ATT&CK Technique T1190 — https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application — mapping for this class of attack.)
3. CWE-863: Improper Authorization — https://cwe.mitre.org/data/definitions/863.html (Details on the flaw class associated with this CVE.)
4. Tanium Official Security Page (for future patches) — https://www.tanium.com/company/security/ (Reserve for vendor advisories; no specific CVE-2026-87046 entry available as of this report date.)
5. CISA KEV Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (No entry for CVE-2026-87046; confirms no known in-the-wild exploitation.)

Note: As of the report date, NVD indicates there is no EPSS score available and no CISA KEV listing for CVE-2026-87046. There is no public exploit code or proof-of-concept. This report will be updated when the vendor publishes patch details.