CVE-2026-87076: Tanium Discover Information Disclosure Flaw

CVE-2026-87076 Overview

CVE-2026-87076 is an information disclosure vulnerability affecting the Tanium Discover module. Tanium addressed the issue through a security advisory published under identifier TAN-2026-024. The flaw allows an authenticated network attacker with low privileges to access sensitive information without user interaction. The weakness is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
An authenticated attacker with low-level privileges can retrieve confidential data from Tanium Discover over the network, undermining the confidentiality of asset discovery information.

Affected Products

Tanium Discover (see Tanium Security Advisory TAN-2026-024 for affected versions)
Specific fixed versions are documented in the vendor advisory
Consult the vendor advisory for the complete affected version matrix

Discovery Timeline

2026-09-16 - CVE CVE-2026-87076 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87076

Vulnerability Analysis

CVE-2026-87076 exposes sensitive information handled by the Tanium Discover module. Discover is responsible for identifying unmanaged interfaces and assets across an environment. A flaw in how the component enforces data access allows an authenticated user to view information beyond their intended scope.

The issue impacts confidentiality only. Integrity and availability of the platform are not affected by this weakness. Exploitation requires network access to the Tanium server and valid, low-privileged credentials. No user interaction is required to trigger the disclosure.

Root Cause

The root cause is improper enforcement of access controls on sensitive data within Discover, mapping to [CWE-200]. The component returns information that should be restricted based on the requesting principal's privileges. Refer to the Tanium Security Advisory TAN-2026-024 for the vendor's technical description.

Attack Vector

An authenticated attacker sends crafted requests to the Discover module through the standard network interface. Because privileges required are low, any account with basic access to the platform can attempt exploitation. The vendor has not published proof-of-concept code, and no public exploit is currently available. See the Tanium Security Advisory TAN-2026-024 for further technical context.

Detection Methods for CVE-2026-87076

Indicators of Compromise

Unexpected access to Discover module endpoints from low-privileged accounts
Unusual volume of Discover data queries originating from a single user session
Access to asset or interface data by users outside their assigned scope

Detection Strategies

Enable and review Tanium audit logs for Discover module access events
Correlate authentication events with Discover data retrieval activity
Baseline normal Discover usage patterns and alert on deviations by user role

Monitoring Recommendations

Ingest Tanium server audit logs into a centralized SIEM for correlation
Track privileged and low-privilege access to the Discover module separately
Set alerts on repeated Discover API calls from accounts that historically do not use the module

How to Mitigate CVE-2026-87076

Immediate Actions Required

Review the Tanium Security Advisory TAN-2026-024 and identify affected Discover versions in your environment
Apply the vendor-provided update as soon as it is validated in a test environment
Audit user accounts with access to the Discover module and remove unnecessary privileges

Patch Information

Tanium has addressed CVE-2026-87076 in an updated release of Discover. Fixed version details and download instructions are documented in the Tanium Security Advisory TAN-2026-024. Customers should follow the vendor's upgrade guidance and validate that fixed builds are deployed across all Tanium servers running Discover.

Workarounds

Restrict access to the Discover module to only users who require it for daily operations
Enforce the principle of least privilege on all Tanium role assignments
Increase logging verbosity for Discover-related actions until patching is complete

bash

# Configuration example
# Refer to the Tanium Security Advisory TAN-2026-024 for vendor-provided
# upgrade commands and role hardening guidance:
# https://security.tanium.com/TAN-2026-024