CVE-2026-87047

Executive Summary

CVE-2026-87047 is an improper access control vulnerability in Tanium Comply, a compliance and configuration auditing module within the Tanium endpoint management platform. The flaw, classified under CWE-639 (Authorization Bypass Through User-Controlled Key), allows a low-privileged, network-accessible attacker to bypass authorization checks and access resources, modify data, or perform actions beyond their permitted scope. The vulnerability carries a CVSS score of 6.3 (Medium severity) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, indicating low confidentiality, integrity, and availability impact but requiring no user interaction and only low privileges. No patch is currently available from any tracked source, and no public exploit code or PoC has been identified. Organizations running Tanium Comply should treat this as an actively exploitable risk within their endpoint management infrastructure.

Technical Analysis

Tanium Comply is a module in the Tanium platform responsible for continuous compliance monitoring, configuration auditing, and security policy enforcement across managed endpoints. The vulnerability described in the NVD entry is categorized as an improper access control condition specifically mapped to CWE-639 — Authorization Bypass Through User-Controlled Key.

The CWE-639 vulnerability class describes a scenario where a system's authorization mechanism relies on user-supplied input (such as an identifier, object reference, resource key, or session token) without performing adequate server-side verification of whether the requesting principal is authorized to access the referenced object. In the context of Tanium Comply, this implies that certain resources or operations — potentially compliance reports, scan results, configuration baselines, or management actions — are indexed by keys or identifiers that a low-privileged user can manipulate or enumerate to access data or functions owned by other tenants, users, or higher-privileged roles.

Because the NVD description provides minimal technical detail — containing only the vendor acknowledgement that Tanium addressed (or is addressing) an improper access control vulnerability in Comply — the precise affected endpoint, parameter name, and internal implementation mechanism are not available for disclosure in this report. What can be derived from the CVSS vector and CWE mapping is: the vulnerability is network-exploitable (AV:N); requires low attacker privileges (PR:L); requires no user interaction (UI:N); and yields low-level impact across confidentiality, integrity, and availability (C:L/I:L/A:L).

Given the architecture of Tanium Comply, which operates against a central Tanium server with role-based access control (RBAC), this vulnerability likely involves horizontal or vertical privilege escalation where a standard user (e.g., an auditor with limited scope) can manipulate a parameter that references compliance objects. The low integrity and availability impact subscores suggest the attacker may be able to override compliance data, tamper with audit records, or interfere with limited Comply functionality, but not conduct wholesale compromise of the underlying Tanium platform.

Insufficient technical detail is available from the NVD description to specify exact endpoints, API routes, or function names. The assessment above is derived from the CWE classification, CVSS vector, and known architectural patterns of the Tanium Comply module.

Exploitation Scenarios

Attack Chain Summary:

Given the classification of this vulnerability as CWE-639 with a network attack vector and low privilege requirement, the following exploitation scenario is the most probable based on the vulnerability class. No public PoC exists; this attack chain is inferred from the CWE-639 vulnerability class and CVSS data.

Step 1 — Reconnaissance and Target Identification: An attacker with valid low-privileged credentials to a Tanium environment first enumerates the Comply module's accessible functionality — including compliance dashboards, scan history views, policy configuration screens, and reporting interfaces. The attacker maps the URL structure or API endpoints that reference compliance objects by numeric or opaque identifiers (e.g., scan IDs, report IDs, policy group IDs — actual parameter names not disclosed in available data).

Step 2 — Flaw Class Triggering: The attacker identifies a request where the server retrieves or acts upon a compliance object using an identifier supplied by the client. By replacing the legitimate identifier with a different value — either sequentially enumerating adjacent IDs or guessing GUIDs/keys belonging to other users or higher-privileged scopes — the attacker tests whether the server enforces authorization checks server-side or blindly trusts the user-controlled identifier.

Step 3 — Validation and Exploitation: If the server-side authorization is missing or improperly scoped, the attacker can access compliance reports, scan results, or audit configurations belonging to other organizational units or users. At the integrity level, the attacker may be able to suppress or modify compliance records — for example, altering scan outcomes, changing policy assignment metadata, or tampering with evidence collected for regulatory compliance (e.g., PCI-DSS, HIPAA, SOX reporting). At the availability level, the attacker could disrupt Comply operations by modifying referenced objects or interfering with scheduled compliance scans.

Step 4 — Post-Exploitation Impact: Post-exploitation effects are constrained by the CVSS subscores (C:L/I:L/A:L). The attacker leverages accessed confidentiality data to inform further attacks (e.g., discovering misconfigured endpoints from compliance reports). The integrity impact may allow the attacker to mask real compliance failures or to fake compliance status, undermining the utility of the Comply module as a control-validation mechanism. Persistent access is not indicated by the vulnerability itself; however, the attacker may chain this with other Tanium privileges to gain deeper access.

Constraints: The low confidentiality and integrity impacts limit the value proposition for sophisticated adversaries; however, the low exploit complexity and absence of user interaction make this vulnerability attractive for opportunistic attackers already inside an environment with low-privileged credentials.

Impact Assessment

Business Impact: Tanium Comply is deployed in enterprises to maintain continuous compliance posture across thousands of endpoints. An authorization bypass in this module has disproportionate impact relative to its modest CVSS score, because compliance data is highly sensitive and often subject to regulatory audit. Compromise of the integrity of compliance data — even at a "low" level per CVSS — can result in failed audits, regulatory fines, loss of certification (e.g., SOC 2, ISO 27001), and reputational damage if an organization is found to have acted on falsified compliance evidence.

Affected Systems: All Tanium environments where Comply is deployed. The affected version range has not been publicly disclosed. Organizations running Tanium Comply in multi-tenant configurations, or with delegated administration where low-privileged users have separate compliance scoping, are at heightened risk because the flaw enables cross-scope access.

Blast Radius: The CVSS subscores indicate the attacker gains low-level capability across all three security objectives — confidentiality (C:L), integrity (I:L), and availability (A:L). However, because the attack requires only low privileges (PR:L), no user interaction (UI:N), and has a network vector (AV:N) with low attack complexity (AC:L), the accessibility is high for any authenticated user within the network. The blast radius includes: exposure of confidential compliance data across organizational boundaries; potential to alter compliance evidence; and ability to interfere with compliance monitoring operations. Lateral movement or privilege escalation beyond Comply is not directly indicated by the CVSS vector.

CISA KEV Status: Not listed in CISA's Known Exploited Vulnerabilities catalog. No public exploit code, Nuclei template, or proof-of-concept is available at the time of writing.

EPSS: Not yet scored by FIRST.org.

Detection Guidance

Detection Assumption: Because no patch exists and no exploit code has been released, detection strategy focuses on anomalous access patterns consistent with CWE-639 exploitation: sequential or out-of-scope identifier usage in Comply API/UI requests, cross-scope access attempts, and data retrieval patterns inconsistent with assigned roles.

Sigma Rule

title: Tanium Comply - Potential Authorization Bypass via IDOR
id: <UUID_HERE>
status: experimental
description: Detects sequential enumeration of identifiers in Tanium Comply web requests which may indicate CWE-639 authorization bypass attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-87047
author: Valters IT Threat Intelligence
date: 2026/01/15
logsource:
    category: web
    product: tanium_comply
detection:
    selection_base:
        cs-method:
            - 'GET'
            - 'POST'
    selection_compromise_uri:
        cs-uri-query|contains:
            - 'comply'
            - 'report'
            - 'scan'
COMMENT: Actual URL path patterns for Tanium Comply are not disclosed in public CVE data; tuned to raw pattern
    selection_suspicious_ids:
        cs-uri-query|re: 'id=\d{1,6}'  # sequential numeric IDs frequently indicate IDOR
    selection_sequence:
        cs-uri-query|re: '^.*(id=(\d+)).*id=(\1)'  # repeated ID access pattern
    selection_rapid_enumeration:
        # Multiple distinct compliance-object accesses within a short window
        timeframe: 5m
        condition: selection_base and selection_compromise_uri and selection_suspicious_ids and selection_rapid_enumeration|count(cs-uri-query) by src_ip > 20
    condition: selection_base and selection_compromise_uri and selection_suspicious_ids
level: medium
falsepositives:
    - Legacy reporting tools that enumerate compliance scans in batches
    - Administrative scripts performing data migration
tags:
    - cve.2026-87047
    - attack.t1548
    - attack.privilege_escalation

YARA Rule

rule Tanium_Comply_IDOR_Exploitation
{
    meta:
        author = "Valters IT Threat Intelligence"
        date = "2026-01-15"
        description = "Detects potential exploitation of CVE-2026-87047 — Tanium Comply authorization bypass (CWE-639)"
        cve = "CVE-2026-87047"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87047"
        severity = "medium"
        tags = "CWE-639 IDOR Tanium"
    strings:
        $s1 = "comply" ascii wide nocase
        $s2 = "report" ascii wide nocase
        $s3 = "scan" ascii wide nocase
        $s4 = "policy" ascii wide nocase
        $s5 = "baseline" ascii wide nocase
        $s6 = "authorization" ascii wide nocase
        $s7 = "access_denied" ascii wide nocase
        $s8 = "permission" ascii wide nocase
        $s9 = "unauthorized" ascii wide nocase
        $s10 = "forbidden" ascii wide nocase

        // HTTP-level signals of attempted enumeration
        $http1 = "GET /" ascii
        $http2 = "POST /" ascii
        $http3 = "id=" ascii nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464c457f or uint16(0) == 0x4D5A
        and 2 of ($s1, $s2, $s3, $s4, $s5)
        and 3 of ($s6, $s7, $s8, $s9, $s10)
        and $http3
        and filesize < 5MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87047 Tanium Comply IDOR Authorization Bypass Attempt"; flow:established,to_server; content:"comply"; http_uri; nocase; content:"scan"; http_uri; nocase; content:"id="; http_uri; pcre:"/id=[0-9]{1,6}/"; classtype:attempted-recon; reference:cve,2026-87047; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-87047; sid:10087047; rev:1;)

Elastic Detection

// Detect high-frequency enumeration of compliance object references from a single source
// Assumes Tanium Comply web traffic is captured in Apache/nginx access logs or similar
sequence by source.ip with maxspan=5m
  [any where process.name == "apache2" or process.name == "nginx"]
  [network where http.request.method in ("GET","POST")
     and http.request.uri contains "comply"
     and http.request.uri contains "id="
     and http.request.uri matches "id=\\d{1,6}" ]
  | scan count(event) > 20

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis OR sourcetype=nginx:plus:access
  uri_path="*comply*" AND (uri="*scan*" OR uri="*report*")
  AND (uri="*id=*" OR uri="*policy=*" OR uri="*group=*")
| rex field=uri "id=(?<target_id>\d{1,6})"
| stats count BY src_ip target_id
| where count > 20 OR count < 3

Wazuh OSSEC Rule

<group name="tanium_comply,">
  <rule id="100870" level="10" frequency="20" timeframe="300">
    <decoded_as>json</decoded_as>
    <field name="web_src_ip">\.+</field>
    <field name="web_uri">comply</field>
    <field name="web_uri">(scan|report|policy|baseline)</field>
    <field name="web_uri">id=\d{1,6}</field>
    <description>CVE-2026-87047 Tanium Comply IDOR exploitation attempt detected - rapid enumeration from $(web_src_ip)</description>
    <group>cve-2026-87047,idor,authentication,</group>
    <mitre>
      <id>T1548</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: CRITICAL — No patch available. Patch confidence is 0/4 with no patch evidence from any tracked source. Vendor fix designation is N/A. The Tanium advisory referenced in the NVD description indicates the vendor has addressed or is addressing the issue, but no specific patch version or release date has been published to any tracked channel.

Immediate Mitigations:

1. Restrict Comply module access — Limit access to Tanium Comply to only users with a demonstrated business need. Review role definitions and remove low-privileged accounts from Comply groups where possible.
2. Network segmentation — Isolate Tanium server traffic on a dedicated management VLAN. Restrict inbound access to the Tanium server's web/API interface to trusted administrator workstations only.
3. Enhanced logging — Ensure the Tanium server logs all Comply module API requests, including source IP, user principal, and requested object identifiers. Enable verbose audit logging for all Comply operations.
4. Monitor for enumeration — Deploy detection rules (see Detection Guidance above) to flag sequential or bulk access to compliance object identifiers from users with low privileges.
5. Implement compensating controls — If possible, place a Web Application Firewall (WAF) or reverse proxy in front of the Tanium web interface to pattern-match and block sequential ID enumeration requests. Note: this may impact legitimate functionality; test thoroughly.

Patch/Upgrade Steps:

1. Monitor Tanium's official security advisories and the NVD entry for CVE-2026-87047.
2. When a patched version of Tanium Comply is released, apply it per the vendor's upgrade procedure in a staged manner: test in a staging environment first, then roll out to production.
3. Subscribe to Tanium's security notification RSS feed or advisory mailing list to receive earliest notification of patch availability.

Long-Term Hardening:

1. Adopt least-privilege principles for all Tanium roles, including Comply roles. Review role scoping quarterly.
2. Implement multi-factor authentication (MFA) for all Tanium console and API access to reduce the risk of low-privileged credential compromise that would enable this attack.
3. Perform regular authorization testing — include IDOR checks (e.g., attempting to access objects referenced by IDs outside your assigned scope) in internal penetration test procedures.
4. Verify forensic integrity of compliance data — when the patch becomes available, reconcile compliance reports stored before patching against authoritative endpoint data to detect potential integrity tampering.
5. Consider compensating technical controls — enforce server-side authorization controls at the API gateway level if feasible in your environment.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-87047 (National Vulnerability Database; CVE-2026-87047 description and CVSS data)
2. Tanium Security Advisories — https://www.tanium.com/security/ (Vendor advisory page; monitor for Comply-specific disclosures)
3. MITRE ATT&CK — https://attack.mitre.org/techniques/T1548/ (Abuse Elevation Control Mechanism — MITRE technique reference)
4. CWE-639 MITRE — https://cwe.mitre.org/data/definitions/639.html (Authorization Bypass Through User-Controlled Key — weakness description)
5. CISA Known Exploited Vulnerabilities — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (No entry for CVE-2026-87047 as of report date)

Threat Actor Campaigns: No known threat actor campaigns or exploit-in-the-wild evidence has been identified for CVE-2026-87047 at the time of writing. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code or proof-of-concept has been released. Monitoring should continue as the vulnerability is newly published and exploit development typically follows within 30–90 days of public disclosure, particularly for network-exploitable authorization flaws requiring low privileges.