THREAT INTELLIGENCE REPORT — CVE-2026-87084

Executive Summary

CVE-2026-87084 is a server-side request forgery (SSRF) vulnerability residing in the Enforce component of the Tanium endpoint management platform. A low-privileged authenticated user can leverage this flaw to perform arbitrary HTTP requests from the server context, potentially reaching internal services and resources that are not otherwise accessible from the network. With a CVSS score of 7.7 (High) and a scope change indicating the compromised component differs from the impacted resource, successful exploitation could lead to unauthorized disclosure of sensitive internal data such as cloud metadata, internal API responses, or configuration stores. As of this writing, no patch has been identified from any tracked source, and no public exploit code or proof-of-concept is available.

Technical Analysis

CVE-2026-87084 is classified as a server-side request forgery (SSRF) vulnerability, mapped to CWE-918. The NVD description confirms that Tanium addressed (or is in the process of addressing) this SSRF flaw within the "Enforce" module of its platform. Tanium Enforce is the compliance and policy enforcement component that allows administrators to define and push configuration baselines, security policies, and compliance checks across managed endpoints.

Vulnerability Mechanism

Server-side request forgery arises when an application accepts a user-supplied URL (or a parameter that influences a URL) and fetches that URL from the server's network context without adequate validation or allow-listing. In the context of a policy/compliance management system such as Tanium Enforce, SSRF could be triggered through functionalities that:

1. Import external policy or baseline definitions — An authenticated user with limited permissions might be able to supply a URL to fetch configuration templates, compliance benchmarks (e.g., CIS benchmarks), or other content that the server retrieves on their behalf.
2. Validate external endpoints — Compliance checks might include HTTP-based health checks or reachability tests that accept a URL parameter.
3. Fetch webhooks or notification endpoints — Enforce may support outbound notifications to webhook URLs that could be attacker-controlled.

Because the NVD description does not provide specific function names, URL endpoints, or parameter names, the precise attack vector within Enforce remains undisclosed. The vulnerability class is nonetheless well understood: an attacker-supplied URL is fetched by the server without sufficient validation of the target host or scheme.

Attack Surface

The CVSS vector provides critical insight into the attack surface:

• AV:N (Network) — The vulnerability is exploitable over the network. The Tanium server typically sits on an internal management network, but any authenticated user who can reach the console/API is a potential attacker.
• AC:L (Low Complexity) — No special conditions, race conditions, or difficult-to-predict circumstances are required for exploitation.
• PR:L (Low Privilege Required) — A low-privileged account (e.g., a read-only operator, a limited role user, or a user with restricted module access) is sufficient to trigger the vulnerability.
• UI:N (No User Interaction) — No victim interaction is required.
• S:C (Scope Change) — The vulnerable component (the Tanium Enforce module / server) differs from the impacted resource (internal network services, cloud metadata, etc.). This indicates that the SSRF crosses a trust boundary.

Impact Mechanics

The SSRF allows a low-privileged user to reach internal network resources that they should not be able to access. Typical targets in a Tanium deployment include:

• Cloud instance metadata services (e.g., 169.254.169.254 on AWS, Azure, or GCP), which can expose temporary credentials for the host's IAM role.
• Internal management APIs (e.g., vCenter, configuration management databases, directory services) that may contain sensitive data or enable further lateral movement.
• Internal monitoring or logging interfaces that could leak credentials or session tokens.
• Other Tanium platform components on the same internal network that may have weaker authentication or trust the Enforce server's outbound requests.

The CIA impact is only C:H (High Confidentiality) — the vulnerability primarily leads to unauthorized data disclosure. There is no direct impact to integrity (I:N) or availability (A:N), meaning an attacker can read internal resources but cannot modify or destroy data through this flaw alone.

Exploitation Scenarios

Note: No public PoC exists, and the NVD description provides no function names, endpoints, or parameters. The attack chain described below is inferred from the SSRF vulnerability class and the CVSS vector.

Scenario 1 — Cloud Metadata Credential Theft

This is the highest-impact SSRF exploitation pattern in modern cloud environments.

1. Reconnaissance / Target Identification: An authenticated low-privileged user of the Tanium platform identifies that the Enforce module supports policy import or external URL validation features. The attacker enumerates the UI/API for any input field that accepts a URL — such as a field for importing a compliance baseline from a remote URL.

2. Triggering the Flaw: The attacker submits a URL pointing to the cloud metadata service, e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/. Because no allow-list restricts outbound requests to internal IP ranges, the Tanium Enforce server fetches this URL.

3. Exfiltration: The server returns the JSON document containing temporary AWS/GCP/Azure credentials for the instance's IAM role. The low-privileged attacker reads this response in the UI or captures it through an error message or response body.

4. Post-Exploitation Impact: The attacker now holds valid cloud credentials that may grant broader access to cloud resources (S3 buckets, databases, compute instances), potentially enabling a full cloud-account compromise — all from a low-privileged Tanium account.

Scenario 2 — Internal Network Port Scanning and Service Enumeration

1. Reconnaissance: The attacker identifies the internal IP addressing scheme (e.g., 10.0.0.0/8, 172.16.0.0/12) or discovers internal hostnames via DNS enumeration or prior knowledge of the network.

2. Triggering the Flaw: The attacker submits URLs pointing to internal HTTP services, such as http://10.0.0.5:8080/actuator/env, http://172.16.0.10:9200/, or other internal management ports. Based on response times, content, and error messages, the attacker maps out reachable internal services.

3. Data Exfiltration: Sensitive internal services (Spring Boot Actuator endpoints, Elasticsearch, Docker APIs, internal wikis/CMDBs) return configuration data, credentials, database connection strings, or other sensitive corporate information.

4. Post-Exploitation Impact: The attacker builds a comprehensive map of the internal network and gathers credentials that can be used for lateral movement or direct compromise of additional systems.

Scenario 3 — Accessing Resources on the Tanium Management Network

1. Reconnaissance: The attacker knows that Tanium deployments often include SQL databases, Redis caches, or other backend services on the same management subnet.

2. Triggering the Flaw: The attacker supplies URLs to internal services that bind to loopback or management interfaces (e.g., http://127.0.0.1:9200/ or http://internal-db:5432 for HTTP-based proxies/gateways to those services). While raw TCP protocols like PostgreSQL cannot be exploited directly via HTTP-based SSRF, many services expose HTTP management interfaces or REST APIs that can be reached.

3. Data Exfiltration: The attacker queries internal HTTP APIs to extract configuration data, user lists, encryption keys, or other sensitive platform data.

4. Post-Exploitation Impact: The attacker may obtain credentials to additional Tanium components or adjacent systems, escalating their access from a low-privileged user to a position of significant control.

Impact Assessment

Business Impact

Tanium is an enterprise-class endpoint management platform typically deployed across large organizations (often 10,000+ endpoints). The Enforce module is specifically responsible for compliance and policy enforcement, making its data particularly sensitive. A successful SSRF exploitation can result in:

• Confidentiality Breach (High): Disclosure of internal service data, cloud credentials, and corporate secrets. This is the core impact, reflected in the CVSS C:H rating.
• Regulatory Consequences: Depending on the nature of the data exposed (e.g., PII stored on internal databases, credentials for systems handling regulated data), organizations could face compliance violations under GDPR, HIPAA, PCI-DSS, or industry-specific regulations.
• Reputational Damage: A breach of a security/compliance management platform is particularly damaging, as these tools are trusted to prevent such incidents.
• Supply Chain Risk: If the Tanium server itself manages endpoints for external clients (as in a managed security services provider scenario), the compromise could cascade to client environments.

Affected Systems

• Tanium Enforce module (specific versions not disclosed in available data).
• Any Tanium platform deployment where Enforce is installed and accessible to authenticated users with low privileges.
• Cloud-hosted Tanium deployments (where the metadata service is reachable) are at particularly elevated risk.

Blast Radius

The CVSS scope change (S:C) indicates the SSRF allows the attacker to impact resources outside the vulnerable component's security boundary. This means:

• The blast radius extends beyond the Tanium server itself to any HTTP-reachable service on the internal network.
• The internal network(s) to which the Tanium server has route access become part of the attack surface.
• In cloud deployments, the blast radius can include the entire cloud account if instance credentials are exfiltrated via the metadata service.

Risk Score Interpretation

• CVSS Base: 7.7 (High) — This scoring reflects the moderate complexity of requiring authentication (even if low-privileged) combined with high confidentiality impact and scope change.
• EPSS: Not yet scored by FIRST.org; no exploit-in-the-wild data is available.
• CISA KEV: The vulnerability is NOT listed in CISA's Known Exploited Vulnerabilities catalog.
• Patch Confidence: 0/4 — We have no evidence of any patch from any tracked source. The vendor has not released remediation guidance that we can corroborate.

Detection Guidance

Detection of SSRF is inherently challenging because the malicious request from the server to the internal target often travels over TLS or within the internal network, where monitoring is sparse. The detection rules below focus on observable server-side behavior and application logs where the SSRF request originates.

Sigma Rule

title: Tanium Enforce Outbound SSRF — Internal IP Target
id: c4f5e7a2-9b6d-4a3c-8e1f-2d4b6c8a0e5f
status: experimental
description: Detects outbound HTTP requests from the Tanium Enforce server to internal IP ranges (metadata services, RFC1918, loopback) originating from user-supplied URLs, indicating potential SSRF exploitation of CVE-2026-87084.
logsource:
  category: web_application
  product: tanium
detection:
  selection_source:
    cs-host|endswith: '.tanium.local'
    sc-status: 200
  selection_internal_target:
    cs-uri-query|contains:
      - '169.254.169.254'
      - '127.0.0.1'
      - '::1'
    or:
      cs-uri-query|startswith: 'http://10.'
      cs-uri-query|startswith: 'https://10.'
      cs-uri-query|startswith: 'http://192.168.'
      cs-uri-query|startswith: 'https://192.168.'
      cs-uri-query|startswith: 'http://172.16.'
      cs-uri-query|startswith: 'https://172.16.'
      cs-uri-query|startswith: 'http://172.17.'
      cs-uri-query|startswith: 'https://172.17.'
      cs-uri-query|startswith: 'http://172.18.'
      cs-uri-query|startswith: 'https://172.18.'
      cs-uri-query|startswith: 'http://172.19.'
      cs-uri-query|startswith: 'https://172.19.'
      cs-uri-query|startswith: 'http://172.2'
      cs-uri-query|startswith: 'https://172.2'
      cs-uri-query|startswith: 'http://172.30.'
      cs-uri-query|startswith: 'https://172.30.'
      cs-uri-query|startswith: 'http://172.31.'
      cs-uri-query|startswith: 'https://172.31.'
  selection_low_priv_user:
    cs-username|endswith: ''
  condition: selection_source and selection_internal_target and selection_low_priv_user
  timeframe: 5m
falsepositives:
  - Legitimate internal health checks if Enforce supports URL validation functions.
  - Administrative use of Enforce to import policies from internal file servers.
level: high
fields:
  - cs-username
  - c-ip
  - cs-uri-query

YARA Rule

rule Tanium_Enforce_SSRF_Attempt
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects URL parameters in Tanium Enforce API/UI traffic referencing internal IPs or metadata endpoints, indicating SSRF exploitation attempts."
        date = "2026-02-18"
        cve = "CVE-2026-87084"
        score = 70
    strings:
        $meta_aws = "169.254.169.254" ascii nocase
        $meta_gcp = "metadata.google.internal" ascii nocase
        $meta_azure = "169.254.169.254/metadata" ascii nocase
        $loopback = "127.0.0.1" ascii nocase
        $linklocal = "127.0.0.0" ascii nocase
        $http_local = "http://10." ascii nocase
        $http_local2 = "http://192.168." ascii nocase
        $http_local3 = "http://172." ascii nocase
        $fetch_param = "url=" ascii nocase
        $fetch_param2 = "target=" ascii nocase
        $fetch_param3 = "uri=" ascii nocase
        $fetch_param4 = "endpoint=" ascii nocase
        $fetch_param5 = "source=" ascii nocase
        $enforce_str = "enforce" ascii nocase
    condition:
        any of ($meta_*) or any of ($http_local*) or any of ($loopback*)
        and any of ($fetch_param*)
        and $enforce_str
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-87084 — Tanium Enforce SSRF Attempt to Internal Resource";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"enforce";
    http_uri;
    nocase;
    content:"url=";
    http_uri;
    nocase;
    pcre:"/(?:169\.254\.169\.254|127\.0\.0\.1|10\.[0-9]{1,3}\.|192\.168\.|172\.(?:1[6-9]|2[0-9]|3[0-1])\.)/Ui";
    http_uri;
    sid:87084001;
    rev:1;
    metadata:created_at 2026-02-18, updated_at 2026-02-18, cve CVE-2026-87084;
    reference:url,cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-87084;
)

Elastic Detection

// Elastic EQL — Detect Tanium server requesting internal IPs (potential SSRF)
sequence by process.entity_id
  with maxspan=30s
  [ network where
      event.category == "network" and
      process.name : "*tanium*" and
      source.ip : ("<Tanium_Server_IP>") and
      destination.ip : ("169.254.169.254", "127.0.0.1", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
  ]
  [ http where
      event.category == "web" and
      process.name : "*tanium*" and
      url.full : ("http://*", "https://*") and
      url.domain : ("169.254.169.254", "127.0.0.1") or url.registry.domain : ("10.*","172.*","192.168.*")
  ]

Splunk SPL Query

index=web sourcetype=access_combined OR index=proxy sourcetype=pan:traffic
| where like(uri_path, "%enforce%") OR like(uri_query, "%enforce%")
| regex uri_query="(?i)(url|target|uri|endpoint|source)=https?://(169\.254\.169\.254|127\.0\.0\.1|localhost|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)"
| eval ssrf_detected="CVE-2026-87084-Tanium-Enforce-SSRF"
| table _time, src_ip, user, uri_path, uri_query, dest_ip
| sort _time

Wazuh OSSEC Rule

<group name="tanium_ssrf,">
  <rule id="870840" level="12">
    <decoded>
      <field name="url">(?i)https?://(169\.254\.169\.254|127\.0\.0\.1|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)</field>
    </decoded>
    <field name="url">(?i)enforce</field>
    <description>Tanium Enforce SSRF attempt detected — CVE-2026-87084</description>
    <group>cve-2026-87084,ssrf,tanium,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

IMPORTANT: Current patch confidence is 0/4 — NO patch evidence from any tracked source. The NVD description states Tanium "addressed" the vulnerability, which may imply a fix is in development or has been released but not yet tracked by public sources. Organizations should contact Tanium support for official guidance and patch confirmation.

1. Immediate Mitigations (Compensating Controls)

• Restrict Enforce module administrative access: Since exploitation requires Low privileges (PR:L), review all accounts with any level of access to the Tanium Enforce module. Enforce least-privilege principles — revoke access for users who do not require Enforce functionality.
• Network segmentation: Place the Tanium Enforce server in a restricted network segment such that its outbound access is limited. Use a firewall or IDS to block outbound requests to RFC 1918 addresses, loopback, link-local (169.254.0.0/16), and cloud metadata endpoints.
• Egress filtering: Configure outbound proxy or firewall rules that allow only whitelisted destinations for HTTP/HTTPS traffic from the Tanium Enforce server.
• Block metadata endpoints explicitly: Add explicit rules to block access to 169.254.169.254 (and provider-specific equivalents, e.g., GCP's metadata.google.internal) from the Tanium Enforce server. Most cloud providers now offer redirect/defense features (IMDSv2 in AWS, hop-limit restrictions in Azure).
• Web Application Firewall (WAF) rules: If the Tanium Enforce UI/API is behind a WAF, deploy rules that inspect query parameters for IP addresses in internal ranges.
• Monitor Enforce access logs: Enable comprehensive logging of all Enforce module activities, including URL fetch operations, and alert on anomalous outbound requests.

2. Patch / Upgrade Steps

• Contact Tanium support or your account representative immediately to inquire about the availability of a security patch or hotfix for this vulnerability.
• Request the vendor's specific patch advisory or CVE-mitigating version number. Tanium typically delivers platform updates via its own distribution system.
• Once a patched version is available, follow Tanium's standard upgrade procedure:
  1. Review upgrade prerequisites and compatibility with your environment.
  2. Stage the patch in a test environment first — the Tanium platform is critical infrastructure, and an upgrade failure can affect all managed endpoints.
  3. Schedule a maintenance window; upgrade the Tanium platform modules in the recommended order.
  4. Verify the Enforce module's functionality after upgrade with targeted compliance checks.
• Until a patch is available, treat the Enforce module as a heightened-risk component and compensate accordingly (see Immediate Mitigations).

3. Long-Term Hardening

• Vulnerability management process: Integrate Tanium advisories into your vulnerability management pipeline so that patches are applied within your defined SLA (e.g., 7 days for CVSS ≥ 7.0).
• Periodic security review of Tanium roles/permissions: Conduct quarterly reviews of all Tanium user roles to ensure least-privilege, especially for modules like Enforce that have demonstrated SSRF risk.
• Outbound request allow-listing: Work with Tanium to understand legitimate outbound URL fetch needs of the Enforce module and enforce strict URL allow-lists at the application layer when available.
• Network monitoring: Deploy network traffic analysis (NTA) capabilities that can detect anomalous North-South and East-West traffic from management servers like Tanium.
• Cloud hardening: If Tanium runs on cloud infrastructure, enforce IMDSv2 (AWS) or equivalent, restrict hop limits (Azure), and use private DNS zones so instances cannot resolve metadata endpoints.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-87084
2. Tanium Vendor Site — https://www.tanium.com/ (Vendor advisory page — check for Tanium Security Advisories)
3. CWE-918 — Server-Side Request Forgery — https://cwe.mitre.org/data/definitions/918.html
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/

Threat Actor Campaign Notes

No known threat actor campaigns or exploit-in-the-wild activity have been associated with CVE-2026-87084 at the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No PoC, exploit code, or Nuclei template has been publicly released.

Disclaimer

This report is based solely on the data provided in the CVE intelligence input. Specific implementation details, code-level references, and exact versions are not disclosed in the NVD description. Where specific details are unavailable, analysis is provided at the vulnerability-class level. Organizations should validate all findings against their own instrumentation and consult Tanium's official advisory for authoritative guidance.