CVE-2026-87047: Tanium Comply Auth Bypass Vulnerability

CVE-2026-87047 Overview

CVE-2026-87047 is an improper access control vulnerability in Tanium Comply. The flaw is classified under [CWE-639]: Authorization Bypass Through User-Controlled Key. An authenticated attacker with low privileges can manipulate object references to access resources outside their authorization scope. The vulnerability is exploitable over the network without user interaction. Tanium has published advisory TAN-2026-038 addressing this issue.

Critical Impact
Authenticated users with low privileges can bypass authorization controls in Tanium Comply to access, modify, or affect the availability of resources belonging to other users or tenants.

Affected Products

Tanium Comply (see Tanium Security Advisory TAN-2026-038 for affected versions)

Discovery Timeline

2026-09-09 - CVE CVE-2026-87047 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87047

Vulnerability Analysis

The vulnerability resides in Tanium Comply, a module used for configuration compliance and vulnerability assessment. Improper access controls allow authenticated users to reference objects or resources they are not authorized to access. An attacker with valid low-privilege credentials can send crafted requests over the network to exercise this authorization gap. Exploitation does not require user interaction, and the attack complexity is low.

The issue affects the confidentiality, integrity, and availability of data within the Comply module, though the scope of each impact is limited. Because Comply typically handles compliance findings, benchmarks, and scan results, unauthorized access may expose sensitive posture data or allow tampering with compliance state. The vulnerability has an EPSS probability of 0.154%, indicating a low observed likelihood of exploitation activity at this time.

Root Cause

The root cause is an authorization bypass through a user-controlled key, categorized as [CWE-639]. The application relies on identifiers supplied by the client to select resources but fails to verify that the requesting user is entitled to the referenced object. This is a design-level access control weakness rather than an input validation flaw.

Attack Vector

Exploitation requires network access to the Tanium Comply interface and valid authenticated credentials with low privileges. An attacker substitutes or enumerates object identifiers in API requests to reach data owned by other users. No social engineering or user interaction is required. See the Tanium Security Advisory TAN-2026-038 for vendor-specific technical details.

No verified exploit code is publicly available. Refer to the vendor advisory for authoritative technical details of the affected code paths.

Detection Methods for CVE-2026-87047

Indicators of Compromise

Authenticated Comply API requests that enumerate sequential or unexpected object identifiers across short time windows.
Access patterns where a single low-privilege account retrieves resources associated with multiple other users or tenants.
Audit log entries showing successful reads or modifications of Comply resources outside the actor's assigned scope.

Detection Strategies

Review Tanium Comply audit logs for authorization decisions and correlate resource ownership with the requesting principal.
Baseline normal per-user access volume to Comply objects and alert on statistical outliers.
Inspect web server and reverse proxy logs for parameter tampering patterns targeting Comply endpoints.

Monitoring Recommendations

Forward Tanium Comply access and audit logs to a centralized SIEM for correlation with identity events.
Alert on privilege boundary crossings, such as a standard user accessing administrator-scoped compliance data.
Monitor for repeated HTTP 200 responses following prior HTTP 403 responses from the same session, which may indicate probing.

How to Mitigate CVE-2026-87047

Immediate Actions Required

Apply the fixed version of Tanium Comply as specified in Tanium Security Advisory TAN-2026-038.
Audit existing Comply user accounts and remove unnecessary access, enforcing least privilege.
Rotate credentials for accounts that may have been used to test or exploit the authorization gap.

Patch Information

Tanium has released a fix for this vulnerability. Refer to Tanium Security Advisory TAN-2026-038 for the fixed version numbers and upgrade instructions.

Workarounds

Restrict network access to the Tanium Comply management interface to trusted administrative networks.
Reduce the number of low-privilege Comply user accounts pending patch deployment.
Increase logging verbosity on Comply endpoints and review access events daily until the patch is applied.

bash

# Configuration example
# Restrict Comply endpoint access via firewall to trusted admin subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP