CVE-2026-87105 Overview
CVE-2026-87105 is a SQL injection vulnerability [CWE-89] in Tanium Threat Response. Tanium published Security Advisory TAN-2026-047 to address the issue. An authenticated attacker with low privileges can inject SQL statements through the affected component over the network. Successful exploitation compromises confidentiality, integrity, and availability of the underlying database.
Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the Threat Response database, exposing sensitive incident data and enabling tampering with investigation records.
Affected Products
- Tanium Threat Response (see vendor advisory for affected versions)
Discovery Timeline
- 2026-09-16 - CVE-2026-87105 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-87105
Vulnerability Analysis
The vulnerability arises when Tanium Threat Response constructs SQL statements using untrusted input without proper parameterization or sanitization. An attacker with valid low-privileged credentials can supply crafted input through a network-accessible interface. The application then concatenates the input into a SQL query executed by the backend database.
Because Threat Response stores forensic evidence, detection telemetry, and incident metadata, database compromise directly undermines investigation integrity. An attacker can read arbitrary tables, modify records to hide activity, or disrupt service by dropping or corrupting data.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Input received from an authenticated user reaches a SQL statement without prepared statements or strict input validation. This allows attacker-controlled fragments to alter query semantics.
Attack Vector
Exploitation requires network access to the Threat Response interface and valid low-privileged credentials. No user interaction is required. An attacker submits a request containing SQL metacharacters or injection payloads to a vulnerable parameter. The backend executes the injected query with the privileges of the database service account.
No verified proof-of-concept code is publicly available. Refer to the Tanium Security Advisory TAN-2026-047 for technical specifics on the affected component and parameters.
Detection Methods for CVE-2026-87105
Indicators of Compromise
- Unexpected SQL syntax elements such as UNION SELECT, OR 1=1, or stacked queries in Threat Response HTTP request logs.
- Database errors or long-running queries originating from the Threat Response service account.
- Unusual read access to sensitive tables containing forensic evidence, host inventory, or user credentials.
- Authentication events from low-privileged accounts followed by anomalous query volume against the Threat Response database.
Detection Strategies
- Enable database query logging on the Threat Response backend and alert on syntactically anomalous queries.
- Deploy a web application firewall (WAF) in front of Tanium management interfaces with SQL injection signatures tuned to Threat Response endpoints.
- Correlate application logs with database audit logs to identify user actions that produced unexpected query patterns.
Monitoring Recommendations
- Monitor the Tanium Threat Response service account for atypical database operations, including schema enumeration and bulk exports.
- Track authentication events for low-privileged accounts accessing Threat Response administrative endpoints.
- Baseline normal query patterns and alert on deviations in volume, table access, or query structure.
How to Mitigate CVE-2026-87105
Immediate Actions Required
- Apply the fixed version of Tanium Threat Response as documented in Tanium Security Advisory TAN-2026-047.
- Restrict network access to the Tanium console and Threat Response interfaces to trusted administrative networks.
- Audit all Tanium user accounts and revoke unnecessary privileges, especially low-tier accounts with access to Threat Response features.
- Rotate credentials and database service account passwords following patching if exploitation is suspected.
Patch Information
Tanium has released a patch addressed in advisory TAN-2026-047. Consult the Tanium Security Advisory TAN-2026-047 for fixed version numbers and upgrade instructions specific to your deployment.
Workarounds
- Limit Threat Response access to a minimum set of trusted administrators until the patch is applied.
- Place the Tanium management console behind a WAF configured with SQL injection protection rules.
- Enable enhanced database auditing to shorten detection time if exploitation attempts occur before patching.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
