CVE-2026-87021: Tanium Comply RCE Vulnerability

CVE-2026-87021 Overview

CVE-2026-87021 is an unauthorized code execution vulnerability in Tanium Comply. Tanium published the issue in security advisory TAN-2026-040 and released a fix. The weakness is classified under [CWE-1336] (Improper Neutralization of Special Elements Used in a Template Engine), indicating attacker-controlled input reaches a template evaluation context. An authenticated actor with elevated privileges can leverage the flaw over the network to run code within the Comply component.

Critical Impact
A high-privileged, network-adjacent attacker can achieve unauthorized code execution in Tanium Comply, impacting confidentiality, integrity, and availability of the affected service.

Affected Products

Tanium Comply (see Tanium advisory TAN-2026-040 for affected versions)
Tanium platform deployments running the Comply module
Environments referenced in the vendor security advisory

Discovery Timeline

2026-09-09 - CVE-2026-87021 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87021

Vulnerability Analysis

The flaw sits in Tanium Comply, the compliance and vulnerability assessment module of the Tanium platform. Tanium's advisory describes it as an unauthorized code execution issue, and the CWE mapping to [CWE-1336] points to a server-side template injection class of bug. In this pattern, user-supplied input is passed to a template engine that evaluates expressions instead of treating them as literal text. Successful exploitation grants the attacker code execution in the context of the Comply process.

Exploitation requires network access to the Comply interface and existing high privileges on the platform. Once triggered, the impact spans confidentiality, integrity, and availability of the module, according to the vendor-published metrics. No public proof-of-concept has been released, and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper neutralization of special elements handled by a template engine within Comply. Input that should be treated as data reaches an evaluator that renders it as executable template syntax. This allows an attacker to embed directives that the engine resolves into code or command execution during rendering.

Attack Vector

The attack vector is network-based. An authenticated user with sufficient privileges submits crafted input through a Comply feature that ultimately reaches the vulnerable template evaluation path. No user interaction is required beyond the attacker's own request. Consult the Tanium Security Advisory TAN-2026-040 for specific affected endpoints and inputs.

No verified exploit code is available. Refer to the vendor advisory for technical details.

Detection Methods for CVE-2026-87021

Indicators of Compromise

Unexpected child processes spawned by the Tanium Comply service account on Comply servers.
Comply audit log entries showing high-privilege users submitting unusual template, report, or policy payloads containing expression syntax such as ${...}, {{...}}, or <%...%>.
Outbound network connections from the Comply host to unrecognized destinations shortly after administrative activity.

Detection Strategies

Baseline the normal process tree of the Comply service and alert on deviations, especially shell interpreters or scripting hosts launched as child processes.
Inspect HTTP request bodies to Comply endpoints for template metacharacters submitted by authenticated sessions.
Correlate privileged user actions in Tanium with new file writes, scheduled tasks, or persistence artifacts on the Comply host.

Monitoring Recommendations

Forward Comply application and audit logs to a centralized analytics platform and retain them long enough to support incident review.
Monitor administrative account use in Tanium and alert on off-hours or unfamiliar source IP activity.
Track outbound egress from Comply servers and flag connections to non-Tanium infrastructure.

How to Mitigate CVE-2026-87021

Immediate Actions Required

Apply the fixed Comply release identified in Tanium Security Advisory TAN-2026-040 as soon as change control permits.
Inventory all Tanium deployments running Comply and confirm current module versions against the advisory.
Review recent Comply audit logs for suspicious high-privilege activity predating patch deployment.

Patch Information

Tanium has released updated Comply builds addressing CVE-2026-87021. The vendor documents affected and fixed versions in advisory TAN-2026-040. Administrators should follow standard Tanium module upgrade procedures and validate module health after the update.

Workarounds

Restrict Comply administrative privileges to a minimal set of accounts and require multi-factor authentication for those roles.
Limit network reachability of the Tanium console and Comply endpoints to trusted management networks.
Increase logging verbosity on the Comply module and review activity from privileged accounts until patching is complete.

bash

# Configuration example: restrict console access at the network layer
# Replace CIDR with your administrative subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP