CVE-2026-87105

Executive Summary

CVE-2026-87105 is a SQL injection vulnerability (CWE-89) in Tanium's Threat Response module, assigned a CVSS 3.1 base score of 8.8 (HIGH). An authenticated remote attacker with low privileges can exploit the flaw to fully compromise the confidentiality, integrity, and availability of the affected component, likely including the underlying database. Because Tanium Threat Response is a security-operations and endpoint-investigation platform, successful exploitation could expose sensitive endpoint telemetry, threat-hunting queries, and potentially the broader Tanium data estate. No public exploit, Nuclei template, or PoC exists as of this writing, and the vulnerability has not yet been added to CISA KEV or scored by FIRST.org EPSS.

Technical Analysis

Vulnerability class. CVE-2026-87105 is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). The CNA description states that the issue resides in Tanium Threat Response. No further technical detail — such as the specific injectable parameter, the query construction pattern, the backend database engine, or the API endpoint — was disclosed in the source data. Accordingly, the analysis below stays at the vulnerability-class level and does not assert unverified implementation specifics.

Attack surface. Tanium Threat Response is an incident-response and threat-hunting module that ingests endpoint telemetry and allows operators to run investigative queries across a managed fleet. SQL injection in a security product of this class typically arises where user-supplied input (search terms, filters, saved-query parameters, or labels) is concatenated into a SQL statement rather than being bound through parameterized queries or a safe ORM layer. The injection surface is therefore reachable by any user who can issue queries or interact with the affected interface.

Why the CVSS profile matters. The base vector is:

• AV:N — Attack Vector: Network. The vulnerable component is exploitable over the network, not from an adjacent or local position.
• AC:L — Attack Complexity: Low. No special conditions, race windows, or unusual attacker-controlled state are required; the injection is straightforward to trigger once the surface is reached.
• PR:L — Privileges Required: Low. The attacker must hold some authenticated low-privilege account on the platform. This is the key operational constraint — this is not an unauthenticated remote code path.
• UI:N — User Interaction: None. No victim action (click, open, visit) is needed.
• S:U — Scope: Unchanged. Impact is confined to the security authority of the vulnerable component; the tested score does not model a breakout to a separate trust boundary.
• C:H / I:H / A:H. Full loss of confidentiality, integrity, and availability. For a SQL injection in a data platform, this reflects read-out of the entire database (C:H), ability to modify or destroy data (I:H), and the potential to disrupt or crash the backing service (A:H).

Mechanism at class level. SQL injection enables an attacker to alter the structure of a SQL query executed by the application by supplying crafted input that the application fails to neutralize. Depending on the injection point, this can permit (a) union-based or error-based extraction of data from arbitrary tables, (b) boolean- or time-based blind inference where output is not reflected, and (c) in some database configurations, stacked queries or file/command execution primitives via built-in database features. The confirmed impact class — full C/I/A loss under S:U — is consistent with an attacker obtaining broad read/write access to the backend data store.

Insufficient detail. The following are not established by the available data and should not be assumed: the exact parameter or field name, the HTTP verb or API route, the database engine (MSSQL, PostgreSQL, etc.), whether injection is in-band or blind, and whether stacked queries are possible. Analysts should treat these as unknowns pending vendor clarification.

Exploitation Scenarios

No public PoC is available for CVE-2026-87105. The attack chain below is inferred from the vulnerability class (CWE-89) and the advertised CVSS profile (PR:L, AV:N). No specific function names, endpoints, parameters, or payload strings are asserted, because none appear in the source data.

1. Reconnaissance and target identification. An attacker identifies an internet-exposed or internally reachable Tanium Threat Response deployment. Reconnaissance focuses on locating the query/search interface and confirming a reachable, authenticated session (PR:L implies a valid low-privilege account is required; this could be obtained via credential reuse, a low-privilege service account, or a separately compromised operator login). The attacker fingerprints the product and — where error messages are returned — begins probing for query responses that differ based on injected input.

2. Triggering the flaw class. Holding a low-privilege session, the attacker supplies crafted input through a field that is incorporated into a backend SQL statement. Because the application does not safely parameterize that input, the attacker can alter the logical structure of the executed query. Initial probes would attempt to induce a SQL error or a behavioral difference (true/false response divergence, or a measurable time delay) to confirm the injection is processed server-side.

3. Payload/execution at class level. Once confirmed, the attacker uses standard SQL injection techniques appropriate to the (unknown) backend engine — union-based extraction, boolean-based blind inference, time-based blind inference, or error-based extraction — to read data from the backend store. Where the database supports it and permissions allow, the attacker may escalate to data modification or destructive statements. No specific payload syntax is asserted here, as the database engine is not disclosed.

4. Post-exploitation impact. The CVSS profile (C:H/I:H/A:H, S:U) implies the attacker can fully read, modify, and disrupt the affected data. In the context of a threat-response platform, the exposed data could include endpoint telemetry, query history, stored investigative artifacts, and potentially account or configuration data held in the same database. Integrity impact means the attacker could tamper with security records, undermining the reliability of the platform as a source of truth. Availability impact means the service could be rendered unusable.

Threat-actor relevance. There is no evidence in the provided data of exploitation in the wild, no CISA KEV listing, and no attributed campaign. Because Tanium is a privileged security-management platform, this class of flaw is attractive to sophisticated adversaries who target security tooling to disable or blind defenders — but that is an inference from the product category, not a confirmed observation for this CVE.

Impact Assessment

Business impact. Tanium Threat Response underpins incident response and threat hunting for many enterprises. A SQL injection granting full C/I/A impact against its backing store can expose sensitive endpoint and investigative data, allow tampering with security records, and disrupt a mission-critical security capability. The confidentiality impact is especially significant: data held by a threat-response platform can itself reveal an organization's defensive posture, IOCs, and investigative priorities.

Affected systems. Limited to deployments running Tanium Threat Response. No affected version range was supplied, so all currently deployed versions should be considered candidates until the vendor's advisory is consulted.

Blast radius. CVSS scope is Unchanged (S:U), meaning the scored impact is bounded to the vulnerable component and its security authority — it does not model lateral movement to other trust zones in the base metric. However, because the platform is high-privileged, real-world blast radius could extend well beyond the base score if credentials or configuration data stored in the affected database are reused elsewhere. This is a caveat, not a base-metric claim.

Severity summary. Base score 8.8 (HIGH), driven by network reachability, low complexity, no user interaction, and complete C/I/A loss — tempered only by the requirement for a low-privilege authenticated account. EPSS is not yet scored; no exploitation likelihood estimate is available. Not listed in CISA KEV.

Detection Guidance

Detection below is necessarily generic, because the injectable parameter and endpoint are undisclosed. Rules target the vulnerability class (SQL injection against a Tanium Threat Response surface) and rely on log source placeholders that must be mapped to your actual telemetry.

Sigma Rule

title: Potential SQL Injection Against Tanium Threat Response
id: 7b2f4c9e-1a3d-4e6b-9c21-0f8a2d5e6b71
status: experimental
description: Detects SQL injection patterns targeting Tanium Threat Response query interfaces.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87105
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_keywords:
    - '*UNION*SELECT*'
    - '*OR 1=1*'
    - '*OR%201=1*'
    - '*SLEEP(*'
    - '*pg_sleep(*'
    - '*WAITFOR*DELAY*'
    - '*information_schema*'
    - '*@@version*'
    - '*CONVERT(*SELECT*'
  selection_target:
    cs-uri-query|contains: 'tanium'
  condition: selection_method and selection_keywords and selection_target
fields:
  - c-ip
  - cs-uri
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate security-research or scanner traffic
  - Authorized penetration testing
level: high

YARA Rule

rule CVE_2026_87105_Tanium_ThreatResponse_SQLi
{
    meta:
        description = "Detects SQL injection probe patterns associated with CVE-2026-87105 (Tanium Threat Response SQLi)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87105"
        date = "2026-01-01"
        severity = "high"

    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "' OR '" nocase
        $sqli4 = "information_schema" nocase
        $sqli5 = "WAITFOR DELAY" nocase
        $sqli6 = "pg_sleep(" nocase
        $sqli7 = "SLEEP(" nocase
        $tanium1 = "Tanium" ascii
        $tanium2 = "Threat Response" ascii

    condition:
        uint16(0) == 0x4854 and
        (2 of ($sqli*)) and
        (1 of ($tanium*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87105 Possible SQL Injection Against Tanium Threat Response"; flow:established,to_server; http.method; content:"GET" or content:"POST"; http.uri; content:"tanium"; nocase; http.uri.raw; pcre:"/(UNION[\s\+]+SELECT|OR[\s\+]+1=1|information_schema|WAITFOR[\s\+]+DELAY|pg_sleep\(|SLEEP\()/i"; reference:cve,2026-87105; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87105; classtype:web-application-attack; sid:202687105; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method in ("GET","POST")
      and url.path != null
      and wildcard(url.full, "*tanium*") ]
  [ network where http.request.method in ("GET","POST")
      and wildcard(url.query, "*UNION*SELECT*")
      or wildcard(url.query, "*information_schema*")
      or wildcard(url.query, "*OR 1=1*")
      or wildcard(url.query, "*pg_sleep*")
      or wildcard(url.query, "*WAITFOR*DELAY*") ]

Note: EQL sequence requires an ECS-normalized network data source. If unavailable, use a single-event query filtering url.query for the listed injection tokens combined with a url.full containing the product keyword.

Splunk SPL Query

index=web OR index=proxy
(sourcetype=access_combined OR sourcetype=nginx OR sourcetype=iis)
(uri="*tanium*" OR url="*tanium*")
(uri="*UNION*SELECT*" OR uri="*OR+1%3D1*" OR uri="*information_schema*"
 OR uri="*WAITFOR*DELAY*" OR uri="*pg_sleep*" OR uri="*SLEEP(*")
| eval client=coalesce(src_ip, clientip, c_ip)
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as uris by client
| where count > 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,sql_injection,cve-2026-87105,">
  <rule id="2026872" level="12">
    <if_sid>31100,31101,31103,31104,31106,31108</if_sid>
    <match>tanium</match>
    <regex>(?i)(UNION[\s\+]+SELECT|OR[\s\+]+1=1|information_schema|WAITFOR[\s\+]+DELAY|pg_sleep\(|SLEEP\()</regex>
    <description>CVE-2026-87105: Possible SQL injection attempt against Tanium Threat Response</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,web_attack,</group>
  </rule>
</group>

Map the if_sid web-log parent SIDs to your Wazuh deployment's actual web-server log decoders before deployment. Tune the tanium match to your URL/log format.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED / no patch evidence from any tracked source. The CNA description states Tanium "addressed" the vulnerability, indicating a vendor fix exists, but no advisory ID, release version, or KB reference was provided in this dataset. Do not treat any specific version as fixed based on this report.

1. Immediate mitigations (while patching status is confirmed):

• Restrict network exposure. Do not expose Tanium Threat Response query interfaces to untrusted networks. Enforce access via VPN or a zero-trust proxy, and segment management-plane access from user networks.
• Least privilege. Because exploitation requires only low privileges (PR:L), audit and minimize accounts that can reach the query interface. Ensure no shared or over-privileged service accounts exist for this surface.
• Least privilege on the database. Ensure the application's database account cannot perform stacked queries, file I/O, or OS command execution, and cannot read schemas it does not need. This does not fix CWE-89 but reduces the reachable impact.
• Web application firewall. Deploy WAF rules matching SQL-injection signatures against the affected product path as a compensating control. WAFs are bypassable and must not be treated as a substitute for patching.
• Monitoring. Enable the detection rules above and alert on injection-pattern tokens in requests referencing the product.

2. Patch/upgrade steps:

• Contact Tanium support or the Tanium Trust Center to obtain the specific fixed release for CVE-2026-87105. No version is asserted here because none was supplied.
• Once the fixed version is identified, follow Tanium's standard upgrade procedure: back up configuration and the database, stage the upgrade in a non-production environment, validate, then roll out to production.
• After upgrading, verify the injection surface no longer accepts unsafe input and confirm the fix via vendor guidance.

3. Long-term hardening:

• Adopt parameterized queries / prepared statements and an ORM or safe query builder as the mandatory pattern for all database access in custom or vendor integrations.
• Enforce an SDLC that includes static (SAST) and dynamic (DAST) testing for injection classes (CWE-89) in security tooling, with remediation gates.
• Apply defense-in-depth: database least privilege, network segmentation of security-management planes, MFA and strong authentication for all operator accounts, and continuous monitoring for anomalous query behavior.
• Track CVE-2026-87105 in your vulnerability-management program; re-assess when FIRST.org publishes an EPSS score and when the vendor publishes a formal advisory.

References

1. NVD — CVE-2026-87105: https://nvd.nist.gov/vuln/detail/CVE-2026-87105 (primary record; description and CVSS 3.1 base score 8.8).
2. MITRE CWE-89 — SQL Injection: https://cwe.mitre.org/data/definitions/89.html (vulnerability-class reference).
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ (tactic mapping).
4. FIRST.org EPSS: https://www.first.org/epss/ (EPSS not yet scored for this CVE at time of writing — verify before relying on any likelihood estimate).
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-87105 is not listed as of this writing).
6. Tanium Trust Center / Security Advisories: consult Tanium's official advisory channel for the fixed release and affected-version matrix — no advisory ID or version was available in the supplied data.

Threat actor / exploit-in-the-wild evidence: None available. No public PoC, no Nuclei template, no exploit code, no KEV listing, and no attributed campaign were present in the source data. Any future attribution or in-the-wild reporting should be verified against the vendor and CISA before being treated as fact.