CVE-2026-87088

Executive Summary

CVE-2026-87088 is an unauthorized code execution vulnerability in Tanium Enforce, a module within the Tanium endpoint management and security platform. The vulnerability is classified as CWE-78 (OS Command Injection) and carries a CVSS 3.1 base score of 7.0, with a vector of AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. Exploitation requires local access and user interaction but, if successfully triggered, yields full compromise of confidentiality, integrity, and availability on the affected host.

Technical Analysis

The NVD description states only that Tanium "addressed an unauthorized code execution vulnerability in Enforce." This is a minimal disclosure: no CNA title, no version range, no function names, no parameter names, and no technical root-cause narrative are provided. Consequently, the following analysis is scoped strictly to what the assigned CWE and CVSS vector can support.

CWE-78 (Improper Neutralization of Special Elements used in an OS Command — "OS Command Injection") describes a class of flaws in which untrusted input is concatenated or otherwise incorporated into an operating-system command line without adequate sanitization or parameterization. When an application constructs a shell invocation from externally influenced data, an attacker can inject additional commands or command separators, causing the host to execute arbitrary instructions under the privileges of the vulnerable process.

The CVSS vector provides the strongest available signal about the attack surface:

• AV:L (Local) — The attacker cannot reach the vulnerable code path remotely; access to the local host context is required. This is consistent with a privileged agent, endpoint module, or local management component that processes input from a local source (user, file, or local interface).
• AC:H (High Attack Complexity) — Successful exploitation depends on conditions beyond the attacker's direct control, such as timing, a specific configuration, or a particular environmental state. This substantially reduces opportunistic exploitation.
• PR:N (No Privileges Required) — The attacker does not need pre-existing authenticated privileges to trigger the flaw.
• UI:R (User Interaction Required) — Some action by a legitimate, non-attacker user is necessary for exploitation. This is a critical mitigating factor and heavily constrains mass exploitation.
• S:U (Scope Unchanged) — The vulnerable component and the impacted component are the same security authority; the flaw does not escape its execution context.
• C:H / I:H / A:H — Full loss of confidentiality, integrity, and availability on the affected host once exploitation succeeds, i.e., arbitrary code/command execution with the privileges of the Tanium process.

Combining CWE-78 with AV:L and UI:R, the most defensible class-level description is: a local, user-interaction-dependent command-injection flaw in the Tanium Enforce module that permits execution of arbitrary OS commands in the context of the Enforce/Tanium process. The precise input vector (which field, file, or local interface feeds the unsanitized data) is not disclosed and is not inferred here. Tanium Enforce is associated with endpoint policy enforcement and compliance workflows, so the likely blast radius is any endpoint where the module and its local interaction surface are present — but the exact component boundary cannot be confirmed from the provided data.

No vendor advisory text, changelog, commit reference, or version identifier is available. The patch status is recorded as "CLAIMED" from a single source (NVD) and has not been independently corroborated.

Exploitation Scenarios

Because NVD supplies no implementation-level detail, the attack chain below is described strictly at the vulnerability-class level. No PoC is available in the provided dataset (Nuclei: NO, exploit code: NO), though POC_STATUS is recorded as "Public" per the source data — this discrepancy cannot be resolved from the supplied intelligence and should be treated cautiously.

1. Reconnaissance / target identification. An attacker with access to a host running the Tanium Enforce module identifies that the module is installed and that a locally reachable, user-influenceable input is processed by a command-execution code path. The high attack complexity (AC:H) implies the attacker must identify a specific, non-default condition — likely an uncommon configuration or input state — before the flaw is triggerable.

2. Triggering the flaw class. The attacker supplies crafted input containing OS command metacharacters or command separators to the vulnerable input surface. Per CWE-78, the application fails to neutralize special elements before incorporating them into an OS command. The UI:R rating indicates that eliciting the required user action (for example, an operator performing a routine local action that causes the tainted input to be processed) is a necessary step in the chain — an attacker cannot complete exploitation in isolation.

3. Execution. When the tainted input reaches the shell invocation, the injected command executes with the privileges of the Tanium Enforce process. The AC:H rating suggests exploitation may require precise input construction or favorable timing/environmental conditions; a naive injection attempt may fail.

4. Post-exploitation impact. Reflecting C:H/I:H/A:H, a successful injection yields arbitrary command execution on the endpoint: reading sensitive data, modifying system state and Tanium-enforced policies, and disrupting availability. S:U confirms the compromise is bounded to the affected host and its security authority rather than enabling a scope escape.

Caveat: No public PoC content, code snippet, or independently verified exploit was provided. The chain above is inferred from the CWE-78 classification and CVSS vector only. Any specific field names, command templates, or trigger sequences would be speculation and are deliberately omitted.

Impact Assessment

• Confidentiality (C:H): Full read loss — an attacker executing arbitrary OS commands can access files, credentials, and endpoint telemetry accessible to the Tanium process.
• Integrity (I:H): Full write loss — system state, configuration, and the enforcement posture managed by Tanium Enforce could be altered or subverted on the affected host.
• Availability (A:H): Full availability loss — commands could terminate services, corrupt agent state, or render the endpoint unmanageable.
• Scope (S:U): Impact remains within the vulnerable component's security authority; no direct cross-boundary escalation is implied by the vector.
• Blast radius: Constrained by AV:L (local only), AC:H (narrow triggering conditions), and UI:R (requires a user action). This is not a self-propagating or remotely mass-exploitable defect. Risk is concentrated on hosts where a privileged operator or user interacts with the Enforce module under the specific environmental condition the flaw requires.
• EPSS 0.00120 (2.1% percentile): Very low probability of exploitation in the wild in the near term, consistent with the local, high-complexity, UI-dependent nature of the flaw.
• CISA KEV: NO — No confirmed active exploitation. No threat-actor campaign or in-the-wild evidence was provided.

Given Tanium's role as a high-privilege endpoint management platform, a command-injection flaw in any of its modules is strategically significant even at constrained exploitability: the agent typically operates with elevated system privileges, so command execution in its context is a high-value objective for a post-compromise attacker seeking to pivot within a managed fleet.

Detection Guidance

Sigma Rule

title: Potential Command Injection Exploitation Attempt Against Tanium Enforce
id: 3b1f9c2a-7d4e-4a58-9c1f-87088aa10001
status: experimental
description: Detects child process creation indicative of OS command injection by a Tanium-related process (CWE-78), per CVE-2026-87088. Local, user-interaction dependent.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87088
author: ValtersIT Threat Intelligence
date: 2026/01/01
tags:
  - attack.execution
  - attack.t1204
  - cve.2026.87088
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\TaniumClient.exe'
      - '\TaniumEnforce.exe'
  selection_shell:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
      - '\sh'
  condition: selection_parent and selection_shell
falsepositives:
  - Legitimate Tanium maintenance or scripting activity spawning shells
  - Authorized administrative scripts executed via the Tanium agent
level: medium

YARA Rule

rule CVE_2026_87088_Tanium_Enforce_CommandInjection
{
    meta:
        description = "Detects command-injection payload patterns associated with CVE-2026-87088 (Tanium Enforce, CWE-78). Heuristic."
        author = "ValtersIT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87088"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $cmd_sep_1 = "&&" ascii
        $cmd_sep_2 = "||" ascii
        $cmd_sep_3 = ";" ascii
        $pipe       = "|" ascii

        $shell_1 = "cmd.exe" nocase ascii wide
        $shell_2 = "powershell" nocase ascii wide
        $shell_3 = "/bin/sh" nocase ascii
        $shell_4 = "/bin/bash" nocase ascii

        $ioc_1 = "Tanium" nocase ascii
        $ioc_2 = "TaniumClient" nocase ascii

    condition:
        uint16(0) != 0x5A4D and
        (2 of ($shell_*)) and
        (any of ($cmd_sep_*)) and
        (any of ($ioc_*))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-87088 Potential Tanium Enforce Command Injection Attempt (CWE-78)"; flow:to_server,established; content:"Tanium"; nocase; content:"|26 26|"; within:512; pcre:"/(cmd\.exe|powershell|\/bin\/(sh|bash))/i"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-user; sid:202687088; rev:1; reference:cve,2026-87088; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87088;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("TaniumClient.exe", "TaniumEnforce.exe") and
  process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe", "sh") and
  process.args : ("*&&*", "*||*", "*;*", "*|*")

Splunk SPL Query

index=endpoint sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
| where match(ParentImage, "(?i)\\\\Tanium(Client|Enforce)\.exe$")
| where match(Image, "(?i)\\\\(cmd\.exe|powershell\.exe|pwsh\.exe|bash\.exe)$")
| where match(CommandLine, "(&&|\|\||;|`)")
| stats count min(_time) as first_seen max(_time) as last_seen by host, User, ParentImage, Image, CommandLine
| where count > 0
| table first_seen, last_seen, host, User, ParentImage, Image, CommandLine

Wazuh OSSEC Rule

<group name="tanium,command_injection,cve-2026-87088,">
  <rule id="870880" level="10">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">Tanium(Client|Enforce)\.exe$</field>
    <field name="win.eventdata.image">(cmd|powershell|pwsh|bash)\.exe$</field>
    <description>CVE-2026-87088: Possible command injection via Tanium Enforce - shell spawned by Tanium process</description>
    <mitre>
      <id>T1204</id>
    </mitre>
    <group>cve_2026_87088,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source (NVD) claims a patch; not independently confirmed). The provided data contains no vendor advisory, version identifier, or upgrade target. The following guidance is generic and must be validated against actual Tanium advisories before action.

1. Immediate mitigations

   • Restrict local and interactive access to hosts running the Tanium Enforce module to trusted, least-privilege operators, reducing the UI:R/AV:L exposure surface.
   • Where operationally feasible, apply application allow-listing or EDR process-creation controls so that shell interpreters (cmd.exe, powershell.exe, sh, bash) cannot be spawned as children of Tanium processes.
   • Monitor for anomalous child processes, especially shell interpreters, originating from Tanium-related parent processes (see detection rules above).
   • Treat the endpoint as high-value: Tanium agents commonly run with elevated privilege, so any command-execution foothold in agent context should be triaged as potentially high severity.

2. Patch / upgrade steps

   • Contact Tanium support or consult the Tanium security advisories portal to obtain the specific fixed version addressing CVE-2026-87088, as no version range or patch reference is provided in this dataset.
   • Because patch status is only "CLAIMED," independently verify that the installed Enforce module version is at or above the vendor-remediated build before considering remediation complete.
   • Stage upgrades in a controlled pilot group before fleet-wide rollout, given Tanium's broad endpoint footprint.

3. Long-term hardening

   • Enforce strict privilege separation for Tanium agent processes and review the module's local input surfaces for command-construction patterns.
   • Maintain a documented vulnerability-management workflow that tracks Tanium advisories directly, since third-party feeds (including NVD, in this case) may lag or omit version detail.
   • Apply defense-in-depth: keep EDR/allow-listing, centralized process-creation logging, and endpoint segmentation in place to bound the impact of any future agent-context code-execution flaw.

References

1. NVD — CVE-2026-87088: https://nvd.nist.gov/vuln/detail/CVE-2026-87088
2. CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
3. Tanium Security Advisories (vendor portal — verify CVE-2026-87088 listing): https://www.tanium.com/security/
4. FIRST EPSS — CVE-2026-87088 score/percentile: https://api.first.org/data/v1/epss?cve=CVE-2026-87088
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-87088 not listed as of report generation): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild note: No threat actor campaign, exploit code, or in-the-wild exploitation evidence was provided. CISA KEV status is NO; EPSS is 0.00120 (2.1% percentile). POC_STATUS is recorded as "Public" in the input, but no Nuclei template or exploit code was supplied — this should be independently verified before relying on it.