CVE-2026-87019: Tanium Comply Auth Bypass Vulnerability

CVE-2026-87019 Overview

CVE-2026-87019 is an improper access control vulnerability in Tanium Comply. The flaw is categorized under [CWE-639] (Authorization Bypass Through User-Controlled Key), which typically allows an authenticated user to access or modify resources belonging to other users by manipulating identifiers exposed by the application.

Exploitation requires network access and low-privilege authentication with no user interaction. The impact is limited to integrity, with no direct effect on confidentiality or availability. Tanium has published guidance in security advisory TAN-2026-035.

Critical Impact
An authenticated attacker with low privileges can bypass authorization checks in Tanium Comply to modify resources they should not be able to access.

Affected Products

Tanium Comply (version details listed in vendor advisory TAN-2026-035)
Tanium platform deployments using the Comply module
Refer to the Tanium Security Advisory TAN-2026-035 for the authoritative affected version list

Discovery Timeline

2026-09-09 - CVE-2026-87019 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-87019

Vulnerability Analysis

CVE-2026-87019 stems from insufficient authorization enforcement inside the Tanium Comply module. Comply provides configuration compliance and vulnerability assessment across managed endpoints, so authorization decisions must consistently gate access to scans, findings, and configuration objects.

The advisory categorizes the weakness as [CWE-639], meaning the application relies on user-supplied identifiers when determining resource ownership. When those identifiers are not properly validated against the caller's session context, one authenticated user can reference objects belonging to another tenant, role, or scope. The impact profile identifies a limited integrity effect, indicating that the attacker can alter certain data but cannot read protected data or take the service offline through this issue alone.

Root Cause

The root cause is missing or incomplete server-side authorization checks on object identifiers received through the Comply API or user interface. The application trusts the supplied resource key without confirming that the authenticated principal is entitled to act on that specific object.

Attack Vector

An attacker must first authenticate to Tanium with a valid low-privilege account. From there, the attacker issues crafted requests to Comply that reference object identifiers belonging to another user or scope. Because the check is bypassable, the request executes and modifies the target resource. No user interaction is required, and the attack originates over the network path already used for legitimate Tanium administration.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical exploitation details are not published in the advisory. See the Tanium Security Advisory TAN-2026-035 for vendor-supplied information.

Detection Methods for CVE-2026-87019

Indicators of Compromise

Unexpected modifications to Comply compliance policies, benchmarks, or scan configurations that do not correspond to a change ticket.
Comply API requests from low-privileged accounts referencing object identifiers outside the account's normal scope.
Audit log entries showing write actions on Comply resources by users who historically only read them.

Detection Strategies

Enable and review Tanium audit logging for the Comply module, focusing on create, update, and delete operations.
Baseline normal API usage per role and alert on deviations, particularly authenticated calls that reference identifiers outside expected scopes.
Correlate Comply object modifications with the identity, source IP, and role of the requesting session to surface authorization anomalies.

Monitoring Recommendations

Forward Tanium audit and application logs to a central analytics platform for retention and correlation.
Alert on privilege changes and role assignments within Tanium that could expand a low-privilege account's reach into Comply.
Review inactive or service accounts with access to Comply and disable those no longer required.

How to Mitigate CVE-2026-87019

Immediate Actions Required

Review the Tanium Security Advisory TAN-2026-035 and identify Comply versions running in your environment.
Apply the fixed Comply release specified by Tanium as soon as change control allows.
Audit existing Tanium user accounts and remove Comply permissions from accounts that do not require them.

Patch Information

Tanium has addressed the improper access controls issue in Comply. Refer to advisory TAN-2026-035 for the fixed version numbers and upgrade instructions. Apply the vendor-supplied update to fully remediate CVE-2026-87019.

Workarounds

Restrict Comply access to the minimum set of administrators required for compliance operations.
Rotate credentials for low-privilege accounts that have Comply access and enforce strong authentication.
Increase audit log review frequency for the Comply module until the patch is applied and verified.

bash

# Configuration example: review Tanium Comply role assignments
# Consult Tanium documentation for the exact administrative commands in your version.
# 1. List users with Comply module permissions
# 2. Remove Comply write permissions from accounts that only need read access
# 3. Confirm patched Comply version after upgrade per TAN-2026-035