CVE-2026-87073

Executive Summary

CVE-2026-87073 is an improper access control vulnerability (CWE-862) in Tanium Comply, a module of the Tanium endpoint management and security platform used for compliance scanning and configuration assessment. The flaw carries a CVSS v3.1 base score of 6.5 (Medium), reflecting a network-reachable, low-privilege attack path that yields high integrity impact while leaving confidentiality and availability unaffected. Organizations running affected Tanium Comply deployments should treat this as a priority integrity-control issue, particularly given that Tanium agents typically run with elevated privileges on managed endpoints. No public proof-of-concept, Nuclei template, or exploit code is available, and EPSS remains low (0.00174), indicating limited observed exploitation activity to date.

Technical Analysis

This vulnerability is classified under CWE-862 ("Missing Authorization"), also described by Tanium and NVD as an "improper access controls" flaw. CWE-862 describes a scenario in which an application fails to perform an authorization check before allowing a sensitive action — for example, permitting an authenticated user to invoke an operation that should be restricted to a higher-privileged role, or accessing resources that should remain inaccessible to their role.

The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N provides the strongest available signal about the vulnerability's nature:

• AV:N (Network) — The vulnerable component is reachable over a network, consistent with a Tanium server API, console, or agent-facing service.
• AC:L (Low) — No special conditions or race windows are required to trigger the flaw.
• PR:L (Low Privilege) — An attacker must possess some level of authenticated access. This is consistent with a low-privileged Comply operator, a standard console user, or an authenticated API client.
• UI:N (No User Interaction) — Exploitation does not require a victim to click, confirm, or otherwise interact.
• S:U (Unchanged) — The impact is confined to the vulnerable component; the attacker does not pivot the authorization boundary to affect other security-scoped components in the CVSS model.
• C:N / A:N — No confidentiality or availability impact is expected.
• I:H (High Integrity) — The flaw primarily allows unauthorized modification of data, configuration, or state managed by Comply.

Taken together, the scoring pattern is a textbook signature of an authorization bypass allowing a low-privileged authenticated actor to modify compliance-related content — for example, configuring, editing, or tampering with compliance policies, scan definitions, results, or related configuration state that should require elevated privileges to alter.

The NVD description is deliberately brief: "Tanium addressed an improper access controls vulnerability in Comply." No specific endpoint names, API parameters, HTTP methods, function names, or code paths are provided. As a result, no code-level root cause can be asserted. What can be stated with confidence is the class and mechanism: an authenticated but under-privileged actor can perform an action restricted to a higher privilege level because the server-side authorization check is absent or incomplete.

Notably, no affected version range is available in the supplied data, so defenders cannot rely on version enumeration alone and should instead confirm exposure with the Tanium vendor. The patch is described as "CLAIMED" from a single source (NVD) rather than independently confirmed against a Tanium advisory, so defenders should verify patch applicability directly through Tanium's support portal before treating the issue as closed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-862 missing authorization) and the CVSS vector, without fabricating specific implementation details.

1) Reconnaissance / target identification. An attacker with authenticated low-privilege access to a Tanium Comply environment (e.g., a standard operator account, a service account, or an API client) identifies the Comply management interface or its API surface. Because the flaw is network-reachable (AV:N), no local foothold on the server itself is required. An attacker may discover the target opportunistically via internet or intranet-facing Tanium consoles, or by leveraging a previously obtained low-privilege credential (phishing, credential stuffing, or an insider scenario).

2) Triggering the flaw. The attacker invokes an operation in Comply that is normally reserved for an administrative or otherwise higher-privileged role. Because the server-side authorization check is missing or incomplete (the CWE-862 condition), the low-privileged request is processed as if it came from a privileged actor. This is the core of the vulnerability; the specific request shape is not described in the source data.

3) Execution / payload method. No memory corruption or code injection is involved. The "payload" is a legitimate but unauthorized request against the Comply interface. From the CVSS scoring (I:H, AC:L, UI:N), the attacker's objective is to cause unauthorized modification of data or configuration state within Comply — for example, altering compliance-related records or settings. The exact fields or objects affected are not disclosed.

4) Post-exploitation impact. Success yields high integrity impact confined to the Comply component (S:U). Consequences include tampering with compliance scan data or policy configuration, which can undermine the credibility of compliance reporting and produce a false picture of the security posture of managed endpoints. Because confidentiality and availability are unaffected (C:N/A:N), the attack does not directly exfiltrate secrets or take systems offline — but integrity corruption of a compliance tool can be strategically valuable to an adversary seeking to hide misconfigurations, evade detection, or falsify assurance evidence.

No public exploit code, Nuclei template, or in-the-wild exploitation has been observed. The EPSS score of 0.00174 (7.2th percentile) is consistent with a low-likelihood, unweaponized vulnerability at the time of writing.

Impact Assessment

Business impact. Tanium Comply is used to assess configuration and compliance state across managed endpoint fleets. A missing-authorization flaw that permits unauthorized modification (I:H) allows an attacker to tamper with the accuracy and trustworthiness of compliance outputs and configuration controls. In regulated environments (PCI DSS, HIPAA, SOX, ISO 27001), corrupted or manipulated compliance evidence can invalidate audit attestations and erode the reliability of the platform's assurance chain.

Affected systems. Any Tanium deployment that includes Comply and exposes it to authenticated low-privileged users over the network. Because no affected version range is available, blast radius cannot be scoped by version; defenders must consult the vendor.

Blast radius. Scoped to the Comply component per the "Unchanged" score (S:U). No confidentiality loss is scored, and no availability loss is scored, so the immediate operational disruption is limited. The primary risk is integrity of managed data and configuration.

CVSS subscores. Base 6.5. Exploitability subscore: AV:N/AC:L/PR:L/UI:N → 2.8. Impact subscore: C:N/I:H/A:N → 3.6. The Medium rating is driven by the need for prior authenticated access (PR:L) and the integrity-only impact.

Detection Guidance

Because no specific endpoints or parameters are disclosed, the following detections are behavioral and target anomalous access-control abuse within Tanium Comply rather than a single known request signature.

Sigma Rule

title: Potential Tanium Comply Improper Access Control Abuse (CVE-2026-87073)
id: 6f2a1c3e-9b74-4d51-8a22-tanium87073
status: experimental
description: Detects anomalous authorization activity consistent with CWE-862 access-control abuse in Tanium Comply, where a low-privileged authenticated actor performs privileged modification operations.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87073
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: tanium
  service: comply
detection:
  selection_action:
    event.action|contains:
      - 'comply.policy.modify'
      - 'comply.policy.update'
      - 'comply.policy.create'
      - 'comply.scan.modify'
      - 'comply.scan.update'
      - 'comply.config.change'
  selection_priv:
    user.privilege:
      - 'standard'
      - 'low'
      - 'operator'
      - 'read_only'
  filter_admin:
    user.privilege|contains:
      - 'admin'
      - 'administrator'
      - 'superuser'
  condition: selection_action and selection_priv and not filter_admin
falsepositives:
  - Legitimate delegated administrative workflows
  - Temporary privilege escalation with documented change approval
level: medium
tags:
  - attack.t1190
  - cve.2026.87073
  - cwe.862

YARA Rule

rule CVE_2026_87073_Tanium_Comply_Access_Control_Indicator
{
    meta:
        description = "Heuristic indicator for artifacts referencing Tanium Comply improper access control (CVE-2026-87073); matches audit/log strings, not a memory signature"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87073"
        date = "2026-01-01"
        cve = "CVE-2026-87073"
    strings:
        $comply = "Tanium Comply" ascii nocase
        $cve    = "CVE-2026-87073" ascii nocase
        $cwe    = "CWE-862" ascii nocase
        $access = "improper access control" ascii nocase
        $authz  = "missing authorization" ascii nocase
    condition:
        filesize < 5MB and
        ( $cve or ( $comply and ( $access or $authz or $cwe ) ) )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87073 Possible Tanium Comply Access Control Abuse"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"comply"; nocase; http.uri; content:"policy"; nocase; threshold:type both, track by_src, count 5, seconds 60; reference:cve,2026-87073; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87073; classtype:attempted-admin; sid:202687073; rev:1;)

Elastic Detection

// EQL: Detect low-privileged compliance modification events consistent with CWE-862 abuse
sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" ]
  [ any where event.category == "configuration"
      and event.action in ("policy_modify", "policy_update", "scan_modify", "config_change")
      and tanium.comply == true
      and not user.roles in ("administrator", "admin", "ta_admin", "comply_admin") ]

Splunk SPL Query

index=tanium sourcetype=tanium:comply OR sourcetype=tanium:audit
(event_type=policy_modify OR event_type=policy_update OR event_type=config_change OR action=*policy*)
(user_role="standard" OR user_role="read_only" OR user_role="low" OR user_role="operator")
NOT (user_role="admin" OR user_role="administrator")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as src_ips values(event_type) as actions
        by user_name, dest_host
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="tanium,comply,cve-2026-87073,">
  <rule id="100873" level="10">
    <decoded_as>json</decoded_as>
    <field name="product">tanium</field>
    <field name="event.action">policy_modify|policy_update|config_change|scan_modify</field>
    <field name="user.roles">standard|read_only|low|operator</field>
    <description>CVE-2026-87073: Possible Tanium Comply unauthorized modification by low-privileged user</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>access_control,cwe_862,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source (NVD) claims a fix; not independently confirmed against a Tanium advisory). Verify applicability directly with Tanium before closing.

1. Immediate mitigations.

   • Review and tighten Comply role assignments; enforce least privilege so that standard and operator accounts cannot perform modification operations intended for administrators.
   • Where possible, restrict network exposure of the Comply interface/API to trusted management networks or VPN, reducing the AV:N attack surface.
   • Enable and centralize audit logging for all Comply configuration and policy change operations; alert on low-privileged actors performing administrative-style actions.
   • Rotate credentials for any low-privileged Comply accounts suspected of compromise.

2. Patch / upgrade steps.

   • Open a case with Tanium support to obtain the specific Comply patch version addressing CVE-2026-87073 (no patch version is provided in the available data).
   • Apply the vendor-issued update to the Tanium Server and Comply components following Tanium's documented upgrade sequence.
   • Validate post-patch that a low-privileged account can no longer perform the restricted modification operation.

3. Long-term hardening.

   • Adopt continuous authorization testing (e.g., role-based integration tests) to catch missing-access-control regressions.
   • Implement centralized, immutable audit logging for compliance tooling so that integrity tampering can be detected and investigated.
   • Integrate CWE-862 authorization checks into secure code review and CI pipelines for any extensions or integrations around Tanium.

References

1. NVD — CVE-2026-87073: https://nvd.nist.gov/vuln/detail/CVE-2026-87073
2. MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. FIRST EPSS — CVE-2026-87073 score lookup: https://api.first.org/data/v1/epss?cve=CVE-2026-87073
5. Tanium Security Advisories / Support Portal (vendor advisory to be confirmed by the reader): https://community.tanium.com/ or https://support.tanium.com/

Threat actor / ITW note: No CISA KEV listing, no known threat actor campaign, no public PoC, and no exploit-in-the-wild evidence is available for CVE-2026-87073 at the time of writing. EPSS is 0.00174 (7.2th percentile), indicating low predicted exploitation likelihood. This assessment should be revisited if the vendor advisory, patch confirmation, or exploitation telemetry changes.