CVE-2026-87113

Executive Summary

CVE-2026-87113 is an improper access control vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affecting Tanium's Threat Response module. An authenticated attacker with low privileges can exploit this flaw over the network to bypass authorization checks, potentially leading to unauthorized modification of data while obtaining limited confidential information. Organizations running vulnerable versions of Tanium Threat Response are at risk, as the integrity impact is rated HIGH, allowing an attacker to tamper with critical security telemetry or response actions.

Technical Analysis

The vulnerability resides in Tanium Threat Response and is classified as CWE-639, which refers to an authorization bypass where an attacker can access or manipulate resources belonging to another user by controlling a key or identifier (such as a user ID, object reference, or parameter). The NVD description states that Tanium "addressed an improper access controls vulnerability in Threat Response," indicating that the product failed to properly verify whether a requesting user had the necessary permissions to perform certain actions on specific resources.

Given the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), the attack is network-exploitable with low complexity, requires low privileges (any authenticated user, including one with minimal role assignments), and needs no user interaction. The scope remains unchanged, but the integrity impact is High, meaning an attacker could alter data or configurations within the Threat Response module. The confidentiality impact is Low, suggesting some information disclosure is possible but limited. No public proof-of-concept, exploit code, or Nuclei template exists at this time, and the EPSS score is not yet available. The exact affected versions are not specified in the provided data, and no patch details, workarounds, or vendor fix information have been disclosed. The vulnerability remains unpatched according to tracked sources (Patch Confidence: 0/4).

Without further technical specifics (function names, API endpoints, or parameter names are absent from the description), the precise implementation of the access control flaw cannot be detailed. However, CWE-639 typically manifests when an application trusts a user-supplied identifier to retrieve or modify a resource without verifying ownership or role permissions. In a threat response platform, this could allow a low-privileged user to access investigation data, modify response actions, or tamper with alerts belonging to other users or system-level tasks.

Exploitation Scenarios

Because no public exploit exists and the NVD description is sparse, the following attack chain is inferred strictly from the vulnerability class (CWE-639) and the affected product's typical functionality. No specific function names, API paths, or parameters are invented.

1. Reconnaissance and Target Identification: An attacker with valid low-privileged credentials to the Tanium console (or Threat Response module) identifies the application version or observes normal interactions. The attacker may enumerate resource identifiers (e.g., numeric IDs for investigations, alerts, or response actions) by observing URLs or API requests within the Threat Response interface. Network scanning via Shodan (e.g., http.title:"Tanium") could identify exposed Tanium instances, but the attacker still needs credentials due to the PR:L requirement.

2. Triggering the Flaw Class (Authorization Bypass via User-Controlled Key): Using a low-privileged account, the attacker manipulates a user-controllable key (such as an object reference or record ID) in a request to Threat Response. The application fails to verify that the authenticated user has permission to access or modify the targeted resource, allowing the attacker to bypass intended access controls. This is the essence of CWE-639: the system uses an identifier supplied by the user to directly access a resource without an authorization check.

3. Payload/Execution Method: At the vulnerability-class level, the attacker sends crafted requests (e.g., HTTP requests to the Threat Response API or web interface) containing a modified identifier. Since no specific endpoints or parameters are disclosed, the exact payload cannot be described. The attack requires no user interaction and can be executed over the network with low complexity. The goal is to perform actions—such as modifying response rules, altering investigation status, or accessing limited data—that should be restricted to higher-privileged users.

4. Post-Exploitation Impact: Successful exploitation allows the attacker to tamper with threat response data or configurations (HIGH integrity impact), potentially disrupting security operations, hiding malicious activity, or altering automated response actions. The LOW confidentiality impact suggests some sensitive information (e.g., investigation details) might be exposed. The attacker could also use the compromised module as a foothold to further abuse trust relationships within the Tanium environment, although scope remains unchanged. Persistence and lateral movement would depend on the specific data manipulated.

No public PoC is available; the attack chain is inferred from the vulnerability class and CVSS metrics.

Impact Assessment

The CVSS score of 7.1 (High) reflects a serious risk for organizations using Tanium Threat Response. The integrity impact is High, meaning an attacker can modify critical security data—such as threat alerts, investigation statuses, or response actions—which could lead to missed detections, false negatives, or the neutralization of security controls. The confidentiality impact is Low, indicating limited data exposure. The attack requires only low privileges (PR:L), so any authenticated user with minimal permissions could exploit it. The attack vector is Network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). The scope is unchanged (S:U), so the impact is confined to the vulnerable component, but the blast radius could still be significant within a Tanium deployment, potentially affecting the entire threat response workflow and the integrity of security monitoring. Business impact includes erosion of trust in the security platform, potential regulatory compliance issues if security logs are tampered with, and operational disruption if response actions are altered.

Detection Guidance

Sigma Rule

title: Potential CWE-639 Authorization Bypass in Tanium Threat Response
id: 7f8c9d2e-1a2b-4c3d-9e8f-0a1b2c3d4e5f
status: experimental
description: Detects attempts to exploit an improper access control vulnerability (CWE-639) in Tanium Threat Response by manipulating user-controlled keys.
author: Threat Intelligence Team
date: 2026-05-12
logsource:
  category: webserver
  product: tanium
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem|contains: '/threat_response/'
    cs-uri-query|contains:
      - 'id='
      - 'investigationId='
      - 'alertId='
  condition: selection
falsepositives:
  - Legitimate administrative activity with high privileges
level: medium
tags:
  - attack.t1078
  - cve.2026.87113

YARA Rule

rule CVE_2026_87113_Tanium_ThreatResponse_AccessControl
{
    meta:
        description = "Detects potential exploitation of CVE-2026-87113 in Tanium Threat Response"
        author = "Threat Intelligence Team"
        date = "2026-05-12"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87113"
        cve = "CVE-2026-87113"
    strings:
        $s1 = "Threat Response" ascii nocase
        $s2 = "improper access control" ascii nocase
        $s3 = "Tanium" ascii nocase
        $s4 = "/threat_response/" ascii nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87113 Tanium Threat Response Improper Access Control Attempt"; flow:to_server,established; content:"/threat_response/"; http_uri; content:"id="; http_uri; nocase; classtype:attempted-user; sid:10000001; rev:1; reference:cve,2026-87113; metadata:affected_product Tanium_Threat_Response, attack_target Web_Server, deployment Perimeter, signature_severity Major, created_at 2026_05_12, updated_at 2026_05_12;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where network.protocol == "http" and url.path : "/threat_response/*" and url.query : "*id=*" ]
  [ network where network.protocol == "http" and url.path : "/threat_response/*" and url.query : "*id=*" and not user.roles : "administrator" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/threat_response/*" AND (uri_query="*id=*" OR uri_query="*investigationId=*" OR uri_query="*alertId=*")
| stats count by src_ip, user, uri_path, uri_query, status
| where status=200 AND count > 5
| sort - count

Wazuh OSSEC Rule

<group name="tanium,threat_response,">
  <rule id="100100" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/threat_response/</field>
    <field name="url">\?.*id=</field>
    <description>CVE-2026-87113: Potential Tanium Threat Response improper access control attempt</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_87113,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict network access to the Tanium Threat Response interface to trusted IP ranges or VPN-only access.
   • Enforce least privilege: audit user accounts and remove unnecessary permissions; ensure only authorized personnel have access to Threat Response.
   • Enable detailed logging and monitoring for all Threat Response API and web requests, focusing on abnormal identifier manipulation.
   • Apply virtual patching via WAF rules (if applicable) to detect and block requests with manipulated identifiers targeting Threat Response endpoints.

2. Patch/Upgrade Steps:

   • Since no official patch is available, monitor the vendor's security advisories (Tanium’s website and NVD) for updates.
   • When a patch is released, immediately test and deploy it across all affected Tanium Threat Response instances.
   • Subscribe to Tanium’s security mailing list and CVE feeds to receive timely notifications.

3. Long-Term Hardening:

   • Implement robust authorization checks (e.g., role-based access control with server-side validation of every resource request) in custom integrations and scripts.
   • Conduct regular security assessments and penetration testing of the Tanium environment, specifically testing for CWE-639 patterns.
   • Adopt a zero-trust architecture within the security platform, ensuring that even authenticated users cannot access resources beyond their explicit permissions.
   • Educate security teams on the risks of improper access controls and the importance of prompt patching.

References

1. NVD – CVE-2026-87113: https://nvd.nist.gov/vuln/detail/CVE-2026-87113
2. Tanium Security Advisories: https://www.tanium.com/security/
3. CWE-639: Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
4. MITRE ATT&CK T1078 – Valid Accounts: https://attack.mitre.org/techniques/T1078/
5. CISA Known Exploited Vulnerabilities Catalog (not listed for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept or exploit code is available. No threat actor campaigns or exploit-in-the-wild evidence has been observed at this time.