CVE-2026-87033: Tanium Comply Auth Bypass Vulnerability

CVE-2026-87033 Overview

CVE-2026-87033 is an improper access control vulnerability in Tanium Comply. The flaw is classified under [CWE-639], which covers authorization bypass through user-controlled keys, commonly referred to as Insecure Direct Object Reference (IDOR). An authenticated user with low privileges can interact with the affected component over the network and access or modify resources beyond their authorization scope. Tanium has addressed the issue and published details in security advisory TAN-2026-039. The vulnerability produces limited confidentiality, integrity, and availability impact within the Comply module.

Critical Impact
An authenticated attacker with low privileges can bypass authorization checks in Tanium Comply to reach resources belonging to other users or scopes, resulting in limited data exposure and tampering.

Affected Products

Tanium Comply (specific affected versions listed in advisory TAN-2026-039)

Discovery Timeline

2026-09-09 - CVE-2026-87033 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87033

Vulnerability Analysis

CVE-2026-87033 is an improper access control weakness in Tanium Comply, the compliance and vulnerability assessment module of the Tanium platform. The underlying weakness aligns with [CWE-639], Authorization Bypass Through User-Controlled Key. In this class of flaw, the application relies on an identifier supplied in a request to select a resource, but does not verify that the requesting principal is authorized to access that specific resource.

An authenticated user with low privileges can leverage the flaw over the network. The result is limited unauthorized access or modification of data managed by Comply, without impacting confidentiality of unrelated system data. There is no scope change, meaning the compromise remains confined to the Comply component.

Exploitation does not require user interaction, and attack complexity is low. Tanium's security advisory TAN-2026-039 documents the fix and affected releases. No public proof-of-concept, exploit code, or evidence of exploitation in the wild has been reported. The EPSS probability remains low, consistent with the absence of public exploit activity.

Root Cause

The root cause is missing or insufficient authorization checks on requests that reference resources by identifier. The application trusts an object identifier supplied by an authenticated user without confirming that the identifier maps to a resource the user is entitled to read or modify. This design allows a low-privileged authenticated user to substitute another user's or scope's identifier and act on the referenced object.

Attack Vector

The attack vector is network-based and requires a valid, low-privileged Tanium account with access to Comply. The attacker crafts an authenticated request that references a resource identifier belonging to another user or scope. Because Comply does not adequately validate authorization for that identifier, the request completes and returns or modifies the targeted data. Refer to the Tanium Security Advisory TAN-2026-039 for the technical description and fixed versions.

Detection Methods for CVE-2026-87033

Indicators of Compromise

Authenticated Comply API or UI requests from a single low-privileged account referencing object identifiers that fall outside that account's assigned computer groups or content sets.
Sequential or enumerated identifier patterns in Comply request logs, suggesting IDOR probing.
Access or modification events on Comply reports, findings, or configuration objects by users who do not own or manage those objects.

Detection Strategies

Review Tanium audit logs for Comply actions and correlate the acting user's role and scope with the resource identifiers accessed.
Baseline normal Comply usage per role and alert on deviations, such as a user accessing content sets or computer groups outside their assignments.
Ingest Tanium audit and application logs into a SIEM and build correlation rules that flag identifier enumeration and cross-scope access attempts.

Monitoring Recommendations

Enable and forward Comply and platform audit logs continuously to a centralized logging or SIEM platform.
Monitor authentication events for low-privileged accounts that suddenly generate high volumes of Comply API calls.
Track configuration changes to roles, content sets, and computer groups to detect suspicious privilege or scope alterations.

How to Mitigate CVE-2026-87033

Immediate Actions Required

Apply the Tanium Comply update referenced in advisory TAN-2026-039 as soon as it can be scheduled.
Inventory all Comply users and remove accounts that no longer require access, reducing the population able to exploit the flaw.
Review role assignments, content sets, and computer group scopes to confirm least privilege.
Rotate credentials for any Comply account suspected of misuse based on log review.

Patch Information

Tanium has released a fix for CVE-2026-87033 in Comply. Consult the Tanium Security Advisory TAN-2026-039 for the exact fixed versions and upgrade guidance. Apply the vendor-supplied update through standard Tanium module deployment procedures and verify the installed Comply version after upgrade.

Workarounds

Restrict Comply access to a minimal set of trusted, authenticated users until the patch is deployed.
Tighten role-based access control so that low-privileged accounts cannot reach Comply APIs or views that expose the vulnerable functionality.
Increase audit log review frequency for Comply activity while the patch rollout is in progress.

bash

# Configuration example
# Refer to Tanium Security Advisory TAN-2026-039 for the authoritative
# fixed versions and upgrade procedure. No public configuration workaround
# has been published; the recommended remediation is to apply the vendor patch.