CVE-2026-87048

Executive Summary

CVE-2026-87048 is an improper access control vulnerability (CWE-862, "Missing Authorization") in Tanium Comply, the compliance scanning and assessment module of the Tanium endpoint management platform. The flaw is network-reachable (AV:N) and exploitable by an authenticated low-privileged user (PR:L) without user interaction, resulting in limited integrity and availability impact (I:L/A:L, C:N) — an overall CVSS 3.1 base score of 5.4 (Medium). Because Tanium agents typically run with high privileges across large managed estates, an authorization bypass in the Comply module can let an under-privileged operator invoke functionality reserved for administrators, potentially tampering with compliance scan configuration or disrupting scan availability across the fleet. EPSS is low (0.00170, ~6.7th percentile) and the CVE is not in CISA KEV; no Nuclei template or public exploit code is referenced, though the PoC status field is marked "Public" and should be treated as unverified.

Technical Analysis

CWE-862 (Missing Authorization) describes a class of defect in which an application fails to perform an authorization check before allowing access to a resource or action. In this case, the NVD description is deliberately sparse: "Tanium addressed an improper access controls vulnerability in Comply." No function names, API routes, parameter names, file paths, or object identifiers are provided in the CNA or NVD text. Insufficient technical detail is available to describe the specific vulnerable component, endpoint, or code path.

What can be stated with confidence from the CVSS vector is the shape of the defect:

• AV:N (Network) — the vulnerable surface is reachable over the network, consistent with Tanium's client–server architecture in which endpoints (Tanium Clients) and consoles communicate with Tanium Servers and module services over TCP. No physical or adjacent-network positioning is required.
• PR:L (Low privileges required) — the attacker must already hold some authenticated session within the Tanium Comply surface (for example, a low-privileged console user or a non-administrative module role). This is the defining characteristic of an authorization bypass: the attacker is legitimate but under-privileged, and the flaw permits them to perform actions above their assigned role.
• UI:N (No user interaction) — the victim or an admin need not click anything; exploitation proceeds programmatically once the attacker has the low-privileged foothold.
• S:U (Unchanged) — the impact is scoped to the vulnerable Comply component; the exploit does not cross a security authority boundary into another component per CVSS scope rules.
• C:N / I:L / A:L — there is no confidentiality impact, but limited integrity and limited availability impact. This profile is typical of an authorization flaw that lets a low-privileged user modify or disable compliance-related configuration or scan activity (integrity) and cause a degradation or interruption of the affected service (availability), without exposing sensitive data.

The vulnerability class therefore maps to a broken function-level authorization / missing role check in the Comply module's request-handling layer. Where a well-designed controller would verify that the caller's role is permitted to perform an action, the vulnerable code path either omits the check entirely or enforces it inconsistently, allowing a lower-privileged principal to reach the same handler an administrator would reach. Because the description gives no endpoint, the report does not assert one.

It is worth noting that Tanium deployed fixes are cumulative: the NVD entry states only that a fix was "addressed" by the vendor (patch confidence 2/4 — CLAIMED, single-source from NVD). No version numbers, build identifiers, or advisory IDs are supplied.

Exploitation Scenarios

No public exploit code or Nuclei template is referenced in the supplied data, and the NVD description contains no implementation specifics. The following chain is therefore described at the vulnerability-class level and is inferred from CWE-862 plus the CVSS vector. It does not name any endpoint, parameter, or function, because none are available.

1. Reconnaissance / target identification. The attacker identifies a Tanium-managed environment and locates the Comply module interface (the module's web/console surface is reachable per AV:N). Shodan dorks targeting http.title:"Tanium" or http.html:"Tanium Comply" can be used to fingerprint exposed Tanium consoles; TLS certificate subjects referencing tanium.com further aid identification. The attacker must also obtain or already possess a low-privileged authenticated account (PR:L) — for example, an operator role scoped to the Comply module.

2. Trigger of the flaw class. Holding the low-privileged session, the attacker issues requests to a Comply functionality that should be restricted to a higher role. Because the authorization check is missing (CWE-862), the component processes the request as though the caller were authorized. At the vulnerability-class level this is a function-level authorization bypass: the attacker invokes a privileged operation using a privileged-equivalent request, and the server fails to deny it.

3. Payload / execution method. The "payload" is simply the under-privileged request to the privileged function; no memory corruption, injection, or code execution primitive is involved. CWE-862 exploitation is a logic/access-control abuse, not a memory-safety exploit. The attacker does not need malformed input — only a request that should have been rejected on role grounds. No specific request format can be provided because it was not disclosed.

4. Post-exploitation impact. Consistent with C:N/I:L/A:L, the realistic outcomes are (a) unauthorized modification of compliance configuration, scan definitions, or assessment state (integrity), and (b) disruption or degradation of compliance scanning activity (availability). Because Comply feeds compliance reporting and endpoint assessment, an attacker able to tamper with it could suppress findings, mislabel a host as compliant, or disrupt scheduled scans — undermining the integrity of the organization's compliance posture. There is no stated path to data exfiltration (C:N) or to full system compromise (S:U).

Caveat: any stronger claim (RCE, credential theft, full admin takeover) would be speculation and is explicitly not supported by the data.

Impact Assessment

Business impact. Tanium Comply underpins regulatory and internal compliance reporting across managed endpoint estates. An authorization flaw allowing a low-privileged principal to alter or disrupt Comply functions can degrade the trustworthiness of compliance data — a material concern for organizations relying on Tanium for CIS, DISA STIG, PCI-DSS, or similar benchmark attestations. Suppressed or manipulated scan results can mask non-compliant endpoints.

Affected systems. Any deployment running the affected Tanium Comply module. The exact affected version range is not supplied in the source data; organizations must determine exposure against the vendor's official advisory.

Blast radius. Scoped to the vulnerable component (S:U). Impact is Medium (CVSS 5.4). No confidentiality exposure, limited integrity, limited availability.

Exploitability. AC:L (no special attack conditions beyond the low-privileged foothold), UI:N (no user interaction). EPSS 0.00170 — low predicted exploitation probability, ~6.7th percentile. Not in CISA KEV. Public PoC status flagged but unverified; no exploit code or Nuclei template provided.

Priority. Medium. Exploitation requires an authenticated low-privileged account, which tempers remote risk, but internal threat actors and malicious insiders with limited Tanium roles are realistic adversaries.

Detection Guidance

Detection for CWE-862 is best approached through authorization-event monitoring and audit-log anomaly detection rather than signature matching, since the "exploit" is a legitimate-looking request with insufficient authorization. The rules below are generic to the vulnerability class and intended to be tuned to local Tanium logging schemas.

Sigma Rule

title: Suspected Tanium Comply Authorization Bypass (CWE-862)
id: 7f3c1b90-2e4a-4d18-9c77-87048a001122
status: experimental
description: Detects low-privileged or anomalous access to Tanium Comply privileged functionality consistent with CVE-2026-87048 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87048
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: tanium
  service: comply
detection:
  selection_action:
    event_action|contains:
      - 'comply'
      - 'ComplianceScan'
      - 'ComplyConfig'
  selection_denied_or_elevated:
    - status: 'success'
      user_role|contains: 'Comply'
      required_role|contains: 'Administrator'
    - message|contains: 'authorization'
  condition: selection_action and selection_denied_or_elevated
fields:
  - user
  - user_role
  - src_ip
  - event_action
falsepositives:
  - Legitimate administrative activity by authorized Comply admins
  - Role provisioning changes
level: medium

YARA Rule

rule CVE_2026_87048_Tanium_Comply_AuthzBypass
{
    meta:
        description = "Heuristic detection of references/artifacts associated with CVE-2026-87048 Tanium Comply improper access control"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87048"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $cve    = "CVE-2026-87048" ascii wide nocase
        $prod1  = "Tanium Comply" ascii wide nocase
        $prod2  = "TaniumComply" ascii wide nocase
        $cwe    = "CWE-862" ascii wide nocase
        $authz  = "authorization" ascii wide nocase
        $access = "access control" ascii wide nocase

    condition:
        $cve or ($prod1 or $prod2) and ($cwe or $authz or $access)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $TANIUM_SERVER $HTTP_PORTS ( \
  msg:"Possible Tanium Comply Authorization Bypass Attempt (CVE-2026-87048)"; \
  flow:established,to_server; \
  http.host; content:"Tanium"; nocase; \
  http.uri; content:"comply"; nocase; \
  http.method; content:"POST"; \
  sid:87604801; rev:1; \
  classtype:attempted-user; \
  reference:cve,2026-87048; \
  metadata:created_at 2026_01_01, updated_at 2026_01_01; )

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" and user.roles : "Comply" ]
  [ any where
      event.category == "web" and
      url.path : "*comply*" and
      http.request.method == "POST" and
      event.outcome == "success" ]

Splunk SPL Query

index=tanium sourcetype IN ("tanium:comply","tanium:audit")
(uri="*comply*" OR action="*Comply*" OR action="*Compliance*")
status=success
| stats count min(_time) as first_seen max(_time) as last_seen
        values(status) as statuses values(user_role) as roles
        by src_ip, user, uri, action
| where (roles!="Administrator" AND roles!="Comply_Admin")
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="tanium,web,">
  <rule id="876048" level="10">
    <if_sid>31100,31108</if_sid>
    <url>comply</url>
    <status>^200$</status>
    <description>CVE-2026-87048: Possible Tanium Comply improper access control - privileged function reached with low-privileged session</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>access_control,compliance,</group>
  </rule>
</group>

Detection caveats: because CWE-862 exploitation mimics legitimate calls, high-fidelity detection requires Tanium Comply audit logging that records both the caller's role and the privilege required by the function. Where such logs are unavailable, the rules degrade to anomaly detection and should be baseline-tuned to reduce false positives from authorized administrators.

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (NVD) states Tanium "addressed" the flaw. No CVE-specific patch version, advisory ID, or release build was provided. Treat as unconfirmed until Tanium's official advisory and release notes are verified.

1. Immediate mitigations

   • Restrict network exposure of Tanium console and Comply module interfaces so they are not reachable from untrusted networks; apply network segmentation and access control lists between client networks and servers.
   • Audit and minimize the population of low-privileged Comply accounts; enforce least privilege and review role assignments for over-provisioning.
   • Enable and centralize Comply audit logging; monitor for successful privileged actions initiated by non-privileged roles (see Detection Guidance).
   • Enforce strong authentication (MFA) on all Tanium console and module access to reduce the risk from stolen low-privileged credentials.

2. Patch/upgrade steps

   • Consult the Tanium security advisories page and the Comply module release notes for the specific fixed build corresponding to CVE-2026-87048.
   • Because affected version range is not supplied, inventory all Tanium Comply deployments and their versions first.
   • Upgrade Comply (and dependent Tanium Server components) to the vendor-designated fixed version, then re-verify authorization behavior post-upgrade.
   • Do not assume the current release is patched — the fix is single-source claimed.

3. Long-term hardening

   • Adopt server-side authorization checks consistently (CWE-862 remediation) and add regression tests for role-based access on privileged functions.
   • Implement continuous compliance-configuration integrity monitoring to detect unauthorized changes.
   • Track vendor advisories and subscribe to Tanium security bulletins.
   • Reduce reliance on "security through obscurity" of internal consoles; assume PR:L footholds are obtainable.

References

1. NVD — CVE-2026-87048: https://nvd.nist.gov/vuln/detail/CVE-2026-87048
2. MITRE CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
3. FIRST EPSS — CVE-2026-87048 score page: https://api.first.org/data/v1/epss?cve=CVE-2026-87048
4. Tanium Security Advisories (vendor): https://security.tanium.com/
5. CISA Known Exploited Vulnerabilities Catalog (status check — NOT listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild note: No exploit-in-the-wild evidence, no CISA KEV listing, and no named threat-actor campaign are associated with CVE-2026-87048 in the provided data. EPSS is low (0.00170). The "Public" PoC flag is unverified and unsupported by any supplied exploit code or Nuclei template.

Report prepared by valtersit.com Threat Intelligence. Technical claims are limited strictly to the supplied CVE data; where the NVD description is sparse, this report describes the vulnerability class and explicitly flags missing detail rather than inferring implementation specifics.