CVE-2026-87025: Tanium Comply Auth Bypass Vulnerability

CVE-2026-87025 Overview

CVE-2026-87025 is an improper access control vulnerability in Tanium Comply. The flaw stems from insufficient authorization checks that allow authenticated users to interact with resources beyond their assigned scope. The weakness is classified as Authorization Bypass Through User-Controlled Key [CWE-639], indicating that predictable or manipulable identifiers can be used to access data belonging to other users or tenants.

Tanium published details in Tanium Security Advisory TAN-2026-045.

Critical Impact
An authenticated attacker with low privileges can access or modify Comply resources they are not authorized to view, resulting in limited confidentiality, integrity, and availability impact.

Affected Products

Tanium Comply (specific affected versions listed in TAN-2026-045)

Discovery Timeline

2026-09-09 - CVE-2026-87025 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87025

Vulnerability Analysis

CVE-2026-87025 affects Tanium Comply, the compliance and vulnerability assessment module of the Tanium platform. The vulnerability results from missing or insufficient authorization enforcement on operations that reference user- or tenant-controlled identifiers.

An authenticated user with legitimate low-level access to Comply can substitute identifiers in requests to reach data or actions assigned to other roles or tenants. Because the attack is executed by an authenticated principal over the network without user interaction, exploitation can be automated once the request pattern is known.

The impact is bounded to partial disclosure and partial modification of Comply data. Full system compromise is not indicated by the advisory.

Root Cause

The root cause is Authorization Bypass Through User-Controlled Key [CWE-639]. The application accepts an identifier supplied by the client and performs the requested operation without verifying that the caller is entitled to that specific resource. This pattern is often called an Insecure Direct Object Reference (IDOR).

Attack Vector

Exploitation requires network access to a Comply instance and valid low-privilege credentials. The attacker modifies object identifiers, tenant IDs, or scan/report references in API requests to enumerate or manipulate resources outside their intended authorization boundary. No user interaction is required, and scope remains unchanged.

No public proof-of-concept exploit code is available. Refer to TAN-2026-045 for vendor-supplied technical detail.

Detection Methods for CVE-2026-87025

Indicators of Compromise

Comply API requests where the authenticated user identifier does not match the tenant or owner of the referenced resource.
Sequential or enumerated object identifiers in request URIs originating from a single account within a short interval.
Access to Comply reports, scans, or configuration objects by accounts that historically never interacted with those resources.

Detection Strategies

Enable verbose audit logging on the Tanium Comply application and forward the logs to a centralized analytics platform.
Correlate the requesting user's role and tenant with the owner of each accessed object; flag mismatches.
Baseline normal per-user access patterns and alert on deviations such as sudden broad resource enumeration.

Monitoring Recommendations

Monitor authentication and API activity from all Comply accounts, including service and integration accounts.
Alert on repeated HTTP 200 responses to requests referencing identifiers outside the caller's known scope.
Review privileged Comply role assignments regularly and remove unused accounts.

How to Mitigate CVE-2026-87025

Immediate Actions Required

Apply the fixed Comply version referenced in TAN-2026-045 as soon as change control allows.
Audit existing Comply user accounts and revoke any credentials that are not actively required.
Review recent Comply audit logs for cross-tenant or cross-scope access consistent with the vulnerability pattern.

Patch Information

Tanium has released updated Comply builds that enforce authorization checks on the affected endpoints. Consult Tanium Security Advisory TAN-2026-045 for the specific fixed versions, upgrade path, and any prerequisite Tanium Core Platform requirements.

Workarounds

Restrict network access to the Tanium Comply web interface to trusted administrative networks until patching is complete.
Reduce the privileges of low-trust Comply users and disable inactive accounts to shrink the exploitable population.
Enforce multi-factor authentication on all Tanium console accounts to raise the cost of credential-based access.

bash

# Configuration example
# See TAN-2026-045 for the vendor-supplied upgrade procedure.
# General pattern for restricting network access at the perimeter:
#   allow  src=<admin_subnet>       dst=<tanium_console>  port=443
#   deny   src=any                   dst=<tanium_console>  port=443