CVE-2026-87076

Executive Summary

CVE-2026-87076 is an information disclosure vulnerability in Tanium Discover, the asset discovery and network-visibility component of the Tanium endpoint management platform. According to the CNA description, Tanium addressed the flaw, but no affected version range, patch identifier, or technical root-cause detail was published in the data provided to this report. The CVSS v3.1 score of 6.5 (Medium) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates that an authenticated, low-privileged attacker with network access can achieve a high-confidentiality impact — exposure of sensitive data — without integrity or availability loss. Organizations running Tanium Discover should treat any unpatched deployment as at risk for unauthorized data exposure via a low-privilege account.

Technical Analysis

Vulnerability Class

The CNA assigned CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). This is a broad parent category covering flaws where data that should be protected is made accessible to a party that lacks authorization — including leaked credentials, configuration data, internal network metadata, or other sensitive records.

What the CVSS Vector Tells Us (No More, No Less)

• AV:N (Network) — The attack is mounted over a network path. There is no requirement for adjacent, physical, or local access. This is consistent with a web-console or API-reachable flaw in a server-hosted product such as Tanium Discover.
• AC:L (Low) — No unusual preconditions, race windows, or specialized conditions are needed to exploit. The attack is repeatable under normal operating conditions.
• PR:L (Low) — The attacker must hold some valid, low-privileged account or session on the target. This is a critical constraint: this is not an unauthenticated vulnerability. Anonymous internet attackers cannot trigger it directly.
• UI:N (None) — No victim user interaction is required. The attacker does not need to lure an administrator into clicking a link or opening a file.
• S:U (Unchanged) — Exploitation does not cross a security boundary; the impact is confined to the vulnerable component's own security scope.
• C:H (High Confidentiality) — The confidentiality impact is high. Successful exploitation exposes a substantial amount of sensitive data, not incidental metadata alone.
• I:N / A:N — No integrity or availability impact. This is a pure read/exposure flaw: nothing is modified, deleted, or taken offline.

Attack Surface

The description names Tanium Discover, the module Tanium positions for discovering and inventorying managed and unmanaged assets across an environment. Discover maintains a server-side data store containing inventory and asset metadata. The vulnerability class (CWE-200) combined with the vector suggests that a low-privileged authenticated principal can cause the Discover service to return data beyond what that principal should be entitled to see — for example, query results, inventory records, or internal metadata belonging to other tenants, scopes, or privilege levels.

Root-Cause Assessment

Insufficient technical detail is available to identify the precise code path. The NVD entry provides only the sentence "Tanium addressed an information disclosure vulnerability in Discover." No affected function, endpoint, or parameter names were published in the supplied data, and this report deliberately does not invent them. The most plausible mechanism — based on the CWE-200 classification and the PR:L / C:H combination — is broken access control / missing authorization check on a data-returning operation, but this is an inference from the vulnerability class, not a confirmed finding. Confirmation requires Tanium's advisory or independent research, neither of which is available here.

Exploitation Scenarios

No public PoC or exploit code exists (POC_STATUS: None). The following chain is inferred from the vulnerability class (CWE-200) and the CVSS vector; it contains no fabricated endpoints, parameter names, or function names.

1. Reconnaissance / target identification. The attacker locates a reachable Tanium Discover service (web console or API). Because AV:N applies, this can be done from any network position that can route to the service. Fingerprinting identifies the Discover component and the platform version.

2. Obtaining the low-privilege foothold. Because PR:L applies, the attacker must already possess — or obtain — a low-privileged account on the platform. This could be a legitimate but over-broad service account, a compromised operator account, or a low-tier role issued to a contractor or help-desk user. No privilege escalation is needed to meet the PR:L bar; the account simply needs to exist and be valid.

3. Triggering the flaw. Using the authenticated session, the attacker submits a request to a data-returning operation within Discover. Due to the missing or inadequate authorization enforcement on that operation, the service returns data that the low-privileged principal should not be able to see. Because AC:L applies, the operation succeeds reliably under normal conditions with no race or timing requirement. Because UI:N applies, no administrator needs to be tricked into any action.

4. Post-exploitation impact. The exposed data — inventory records, asset metadata, or other sensitive records within Discover — is exfiltrated to the attacker. Confidentiality impact is rated High. No integrity or availability impact is incurred, so the compromise is silent and does not disrupt platform operation; this reduces the likelihood of immediate detection through operational breakage.

Caveat. The specific request format, affected endpoint, and data type are not disclosed in the provided intelligence. The scenario above describes the flaw at the vulnerability-class level only.

Impact Assessment

• Business impact: Exposure of internal asset inventory and endpoint data held by Tanium Discover. Asset inventory is high-value reconnaissance material: it maps an organization's estate, reveals unmanaged or shadow assets, and can be used to plan follow-on intrusions. In regulated environments this may constitute a reportable data exposure.
• Affected systems: Deployments of Tanium that include the Discover module. A precise affected version list is not available from the supplied data.
• Blast radius: Constrained by PR:L — the attacker needs a valid low-privilege account. However, a single low-tier credential can potentially expose data across scopes the account should not reach, so the blast radius within the Discover data store can be broad despite the low privilege bar.
• CVSS context: A score of 6.5 (Medium) is driven entirely by the confidentiality subscore. The absence of I:N/A:N means no destructive or disruptive capability exists, which caps the severity — but the High confidentiality rating means the recovered data may be operationally sensitive and directly usable for lateral movement planning.

Detection Guidance

Detection centers on anomalous read/query behavior against the Discover service by low-privileged principals, and on monitoring for attribute-based access anomalies. The rules below are behavioral and class-level; they do not assume specific undisclosed endpoints.

Sigma Rule

title: Tanium Discover Information Disclosure - Anomalous Low-Privilege Data Access
id: 8f3c1d2a-4b7e-4a91-9c2d-1f6e0a5b7c33
status: experimental
description: Detects anomalous access patterns consistent with information disclosure (CWE-200) in Tanium Discover by low-privileged principals.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-87076
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
    - attack.t1213
    - cve.2026-87076
logsource:
    category: web
    product: tanium
detection:
    selection_component:
        cs-uri-stem|contains:
            - 'Discover'
            - 'discover'
    selection_status:
        sc-status: 200
    selection_low_priv:
        cs-username|contains:
            - 'readonly'
            - 'viewer'
            - 'operator'
    condition: selection_component and selection_status and selection_low_priv
falsepositives:
    - Legitimate administrative reporting by authorized operators
level: medium

YARA Rule

rule CVE_2026_87076_Tanium_Discover_InfoDisclosure
{
    meta:
        description = "Behavioral marker for Tanium Discover information disclosure (CWE-200). Generic class-level rule; no exploit artifact is public."
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87076"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $disc1 = "Tanium Discover" ascii nocase
        $disc2 = "Discover" ascii nocase
        $err  = "unauthorized" ascii nocase
        $dbg  = "authorization" ascii nocase
        $resp = "application/json" ascii nocase

    condition:
        $disc1 and $resp and 1 of ($err, $dbg)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87076 Possible Tanium Discover Information Disclosure Attempt"; flow:established,to_server; http.uri; content:"Discover"; nocase; http.method; content:"GET"; http.header; content:"Authorization"; nocase; classtype:attempted-recon; reference:cve,2026-87076; sid:202687076; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where network.protocol == "http" and url.path : "*Discover*" and user.name : ("readonly*", "viewer*") ]
  [ network where url.path : "*Discover*" and http.response.status_code == 200 and url.path : "*export*" ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined
| search uri_path IN ("*Discover*", "*discover*")
| search status=200
| eval priv=if(match(user,"(?i)(readonly|viewer|lowpriv|operator)"),"low","other")
| where priv="low"
| stats count values(uri_path) as paths by src_ip, user, priv
| where count > 20

Wazuh OSSEC Rule

<group name="tanium,web,cve-2026-87076">
  <rule id="2026871" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">Discover</field>
    <field name="status">200</field>
    <description>CVE-2026-87076: Possible Tanium Discover information disclosure access detected</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED per tracked evidence. No vendor fix reference, workaround, or affected-version list was provided in the source data.

1. Immediate mitigations

   • Restrict network access to the Tanium Discover service to trusted management networks; do not expose it to untrusted segments or the internet.
   • Apply least privilege aggressively: audit all Tanium accounts and remove or narrow any account with standing read access to Discover data that does not strictly require it. Because PR:L is the only gate, reducing the number of valid low-privilege accounts directly reduces exposure.
   • Monitor and alert on high-volume or anomalous read/query operations against Discover by low-privileged principals (see Detection Guidance).
   • If a vendor-supplied mitigation is available in the Tanium knowledge base, apply it — none was available in this dataset.

2. Patch / upgrade steps

   • Obtain the official Tanium advisory for CVE-2026-87076 and the corrected Discover release. Because no patch version is known here, do not assume a specific build resolves the issue — confirm the fix version with Tanium directly. Upgrade only after validating against Tanium's published guidance.

3. Long-term hardening

   • Enforce role-based access control reviews on a recurring cadence for all Tanium components.
   • Log all access to Discover inventory data centrally and retain it for retroactive hunting.
   • Treat asset-inventory data as sensitive; classify it and apply data-minimization principles.

References

1. NVD — CVE-2026-87076: https://nvd.nist.gov/vuln/detail/CVE-2026-87076
2. MITRE CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
3. Tanium Security Advisories (vendor advisory — exact advisory ID not available in supplied data): https://community.tanium.com/
4. FIRST EPSS (score not yet assigned for this CVE as of report generation): https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (CVE not listed — checked): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild note: No CISA KEV listing, no public PoC, no Nuclei template, and no exploit code were available at the time of writing. There is no evidence of active exploitation in the provided intelligence. All exploitation detail in this report is inferred from the vulnerability class (CWE-200) and CVSS vector, and should be validated against the official Tanium advisory once published.