CVE-2026-87075

Executive Summary

CVE-2026-87075 is an improper access control vulnerability (CWE-863) in Tanium Comply, a compliance assessment and vulnerability management module within the Tanium endpoint management platform. A low-privileged, authenticated network attacker can exploit the flaw to compromise integrity and availability of the affected system, though confidentiality is not impacted. With a CVSS base score of 8.1 (High) and no public exploit or PoC currently available, this represents a significant risk requiring prioritization by organizations running affected Tanium Comply deployments.

Technical Analysis

CVE-2026-87075 is classified under CWE-863 (Incorrect Authorization), a weakness class in which an application fails to properly verify that a user is authorized to perform a given action or access a given resource. The NVD description states that Tanium "addressed an improper access controls vulnerability in Comply." This indicates the flaw resides in the authorization logic of the Tanium Comply component.

The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) tells us several important things about the attack surface and mechanism:

• AV:N (Network) — The vulnerability is exploitable remotely over the network. No physical or adjacent access is required.
• AC:L (Low) — No specialized conditions or race windows are needed; exploitation is straightforward once the attacker has the required access level.
• PR:L (Low Privileges) — The attacker must possess some form of authenticated access, but only at a basic privilege level. This is consistent with an authorization bypass where a low-privilege user can perform actions or reach resources that should be restricted to higher-privilege roles.
• UI:N (No User Interaction) — No victim interaction is required.
• S:U (Scope Unchanged) — The impact remains confined to the vulnerable component.
• C:N (Confidentiality None) — The flaw does not expose sensitive data.
• I:H (Integrity High) — The attacker can modify data or configuration in a meaningful way.
• A:H (Availability High) — The attacker can degrade or deny availability of the affected system or service.

The combination of high integrity and high availability impact with no confidentiality impact, at a low privilege requirement, strongly aligns with an authorization flaw that allows a low-privileged user to invoke privileged operations — for example, altering compliance policies, modifying endpoint assessment configurations, deleting or tampering with compliance data, or disrupting Comply services. Because the description is sparse, the exact endpoint, method, or parameter through which the authorization check is bypassed is not publicly documented. No function names, API paths, or parameter identifiers are available from the source data, and none should be assumed.

It is important to note that Tanium Comply operates within the broader Tanium platform ecosystem, typically deployed in enterprise environments for regulatory compliance scanning and reporting. The product is generally not internet-facing by default, which somewhat constrains the practical attack surface to internal or authenticated network positions — consistent with the PR:L vector.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-87075. The following attack chain is inferred strictly from the vulnerability class (CWE-863) and the CVSS metrics; specific implementation details are not publicly documented.

1) Reconnaissance / Target Identification An attacker first identifies a reachable Tanium Comply instance. This may occur through internal network scanning (since the AV:N vector indicates network exploitability), discovery of Tanium infrastructure via Shodan-style internet-exposed queries where misconfigured deployments exist, or through knowledge of the target's IT management stack obtained via phishing, credential theft, or an initial access broker. The attacker must then obtain valid low-privilege credentials (PR:L), which could come from a compromised standard user account, a contractor account, or stolen session tokens.

2) Triggering the Authorization Flaw Because this is an improper access control vulnerability (CWE-863), the attacker — authenticated as a low-privileged user — sends a request to a Tanium Comply function or interface that should require elevated privileges. The server-side authorization check fails to properly validate the caller's role or permission set, allowing the request to proceed. The exact request structure is not documented publicly. No endpoint, parameter, or function name from the source data is available to cite here.

3) Execution Method At the vulnerability-class level, the attacker leverages the unauthorized action to effect change within the Comply component. Depending on the specific privilege that is improperly enforced, this could manifest as the ability to modify compliance policies, alter assessment results, change configuration, or disrupt service operation. No payload or code-level execution detail is publicly available.

4) Post-Exploitation Impact Consistent with the CVSS assessment (I:H / A:H / C:N), the attacker's post-exploitation capability centers on integrity and availability. This could include falsifying or wiping compliance data, degrading the reliability of the compliance posture reported to security teams, or causing a denial-of-service condition within the Comply service. Because confidentiality is rated None, the flaw is not expected to leak sensitive data directly.

Impact Assessment

CVSS Score: 8.1 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Business Impact: Tanium Comply is used by enterprises to assess endpoint compliance against regulatory and internal security baselines. An integrity compromise of this component can undermine the trustworthiness of compliance reporting — potentially causing auditors or security teams to operate on falsified data. Availability impact means the Comply service itself could be disrupted, delaying or preventing compliance scans and reporting.

Blast Radius:

• Affected Systems: Tanium Comply deployments. The specific version range is not provided in the available data.
• Attacker Position: Network-reachable, authenticated low-privilege user.
• CIA Impact: High integrity and availability impact; no confidentiality impact.
• Scope: Unchanged — impact is confined to the vulnerable component.

EPSS Score: 0.00210 (11.4th percentile), indicating a currently low predicted probability of exploitation in the wild. No CISA KEV listing.

Detection Guidance

Sigma Rule

title: Potential Tanium Comply Improper Access Control Exploitation
id: 8f3a1c2e-4b7d-4e9a-9c1f-taniumcomply87075
status: experimental
description: Detects suspicious access patterns potentially exploiting CVE-2026-87075 improper access control in Tanium Comply
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87075
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.87075
logsource:
  category: web
  product: tanium
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/comply/'
      - '/plugin/comply/'
  selection_status:
    sc-status: 200
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  selection_useragent:
    cs-user-agent|contains:
      - 'curl'
      - 'python'
      - 'Go-http-client'
  condition: selection_path and selection_method and selection_status and selection_useragent
falsepositives:
  - Legitimate administrative automation
  - Authorized vulnerability scanning
level: medium

YARA Rule

rule CVE_2026_87075_Tanium_Comply_Access_Control
{
    meta:
        description = "Detects artifacts related to CVE-2026-87075 Tanium Comply improper access control exploitation attempts"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87075"
        severity = "high"

    strings:
        $comply = "Tanium Comply" ascii wide nocase
        $comply_path = "/comply/" ascii wide
        $cve = "CVE-2026-87075" ascii wide
        $auth = "authorization" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or
        ($comply and any of ($comply_path, $cve))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87075 - Tanium Comply Improper Access Control Exploitation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/comply/"; nocase; http.header; content:"Authorization"; nocase; reference:cve,CVE-2026-87075; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87075; classtype:attempted-admin; sid:202687075; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name, source.ip with maxspan=2m
  [authentication where event.outcome == "success"]
  [http where http.request.method in ("POST", "PUT", "PATCH") and
          url.path : "/comply/*" and
          http.response.status_code == 200]

Splunk SPL Query

index=web OR index=proxy sourcetype=*tanium* OR sourcetype=*comply*
| search (uri_path="*/comply/*" OR url="*/comply/*")
| where (http_method="POST" OR http_method="PUT" OR http_method="PATCH") AND status=200
| eval risk_score = case(
    match(user_agent, "(?i)(curl|python|go-http-client)"), 80,
    match(src_user, "(?i)(admin|service)"), 20,
    1=1, 40)
| where risk_score >= 40
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user_agent, uri_path, status
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="tanium,comply,">
  <rule id="202687075" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/comply/</field>
    <field name="method">POST|PUT|PATCH</field>
    <field name="status">200</field>
    <description>CVE-2026-87075: Potential Tanium Comply improper access control exploitation attempt detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87075,unauthorized_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed)

1) Immediate Mitigations

• Restrict network access to Tanium Comply interfaces to trusted management VLANs and administrative hosts only.
• Enforce least-privilege principles: audit all Tanium user roles and remove unnecessary low-privilege accounts capable of accessing Comply functions.
• Enable enhanced logging and monitoring on Tanium Comply endpoints for anomalous privileged operations initiated by low-privilege accounts.
• Apply network segmentation controls to limit lateral movement to the Tanium platform.

2) Patch / Upgrade Steps

• Apply the vendor patch issued by Tanium for CVE-2026-87075. Because patch confidence is only 2/4 and no specific version is publicly documented, administrators should:
  • Contact Tanium Support directly to obtain the precise fixed version.
  • Verify the patch version matches the deployment before applying.
  • Consult the official Tanium release notes and security advisories.
• Test the patch in a staging environment before production rollout.

3) Long-Term Hardening

• Implement role-based access control (RBAC) reviews on a recurring schedule for all Tanium modules.
• Adopt a formal vulnerability management workflow (e.g., integrate NVD/CISA feeds) to track new Tanium advisories.
• Deploy the detection rules above to monitor for authorization bypass attempts.
• Establish baseline behavior for privileged Comply operations and alert on deviations.

References

1. NVD — CVE-2026-87075: https://nvd.nist.gov/vuln/detail/CVE-2026-87075
2. Tanium Official Security Advisories: https://tanium.com/security
3. CWE-863: Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA KEV Catalog (status: not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor / In-the-Wild Evidence: None currently reported. EPSS 0.00210 (11.4th percentile), no public PoC, no Nuclei template, and no CISA KEV listing indicate no known active exploitation at this time.