CVE-2026-87023: Tanium Comply Path Traversal Vulnerability

CVE-2026-87023 Overview

CVE-2026-87023 is a path traversal vulnerability [CWE-22] affecting Tanium Comply. The flaw allows an authenticated attacker with low privileges to manipulate file path inputs and access resources outside intended directories over the network. Tanium addressed the issue in a security update documented in advisory TAN-2026-028.

The scope-changed nature of the vulnerability means exploitation can affect resources beyond the vulnerable component's security context. Successful exploitation exposes confidential data and can degrade availability of the Comply service.

Critical Impact
An authenticated network attacker can traverse the file system to read sensitive files outside intended directories, potentially exposing configuration data, credentials, or compliance artifacts stored on the Tanium platform.

Affected Products

Tanium Comply (version details listed in Tanium Security Advisory TAN-2026-028)

Discovery Timeline

2026-09-09 - CVE-2026-87023 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87023

Vulnerability Analysis

The vulnerability resides in Tanium Comply, the compliance and vulnerability assessment module of the Tanium platform. The flaw stems from improper limitation of a pathname to a restricted directory, classified under [CWE-22]. An authenticated user submits crafted input containing directory traversal sequences that the application resolves without adequate normalization or validation.

Because the scope changes during exploitation, the vulnerable component can influence resources managed by other components on the host. The confidentiality impact is high, while integrity is not affected and availability impact is low. Attackers exploiting this weakness can read arbitrary files accessible to the Comply service account.

Root Cause

The root cause is insufficient input sanitization on a file path parameter processed by Comply. The application accepts user-controlled path segments and passes them to file system operations without canonicalizing the resolved path or verifying that it remains within an allowed base directory. Traversal sequences such as ../ bypass the intended directory restriction.

Attack Vector

The attack vector is network-based and requires low privileges but no user interaction. An attacker with valid Comply credentials sends a crafted HTTP request that includes traversal metacharacters in a filename or path parameter. The server resolves the path relative to a working directory and returns the contents of files outside the intended scope. Refer to Tanium Security Advisory TAN-2026-028 for authoritative technical details.

No public proof-of-concept exploit code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-87023

Indicators of Compromise

HTTP requests to Tanium Comply endpoints containing traversal sequences such as ../, ..\, %2e%2e%2f, or double-encoded variants
Unexpected Comply service access to files outside its standard installation and data directories
Anomalous file read events by the Comply process targeting system configuration files, credential stores, or user home directories

Detection Strategies

Inspect web server and application logs for Comply request URIs containing path traversal patterns or encoded traversal sequences
Correlate authenticated Comply session activity with file access telemetry from the underlying host to identify off-baseline reads
Deploy web application firewall (WAF) rules that flag traversal payloads in query parameters and request bodies bound for Tanium endpoints

Monitoring Recommendations

Enable verbose audit logging on the Tanium Comply application and forward logs to a centralized SIEM for retention and correlation
Baseline normal file access patterns for the Comply service account and alert on deviations, especially reads of sensitive OS paths
Monitor privileged Comply user accounts for unusual query volume or download activity that could indicate abuse of the traversal flaw

How to Mitigate CVE-2026-87023

Immediate Actions Required

Apply the fixed Comply release identified in Tanium Security Advisory TAN-2026-028 as the primary remediation
Audit Comply user accounts and revoke or rotate credentials for accounts that are inactive, over-privileged, or shared
Review recent Comply access logs for suspicious path parameters or file access anomalies that may indicate prior exploitation

Patch Information

Tanium has released a patched version of Comply that addresses the path traversal weakness. Administrators should consult Tanium Security Advisory TAN-2026-028 for the specific fixed version numbers and upgrade procedures applicable to their deployment.

Workarounds

Restrict network access to the Tanium Comply management interface using firewall rules or network segmentation so only trusted administrative networks can reach it
Enforce least privilege on Comply role assignments to reduce the number of accounts capable of triggering the vulnerable code path
Deploy WAF or reverse proxy filtering to strip or block traversal sequences in requests destined for Comply endpoints until patching is complete