CVE-2026-87034: Tanium Comply SQL Injection Vulnerability

CVE-2026-87034 Overview

CVE-2026-87034 is a SQL injection vulnerability [CWE-89] affecting Tanium Comply. Tanium disclosed and addressed the flaw through security advisory TAN-2026-042. The vulnerability allows an unauthenticated remote attacker to inject SQL statements into the Comply module through a network-accessible interface. Successful exploitation requires user interaction and can result in unauthorized access to backend data, modification of records, or disruption of Comply operations. The scope of the flaw extends beyond the vulnerable component, indicating that a successful attack can impact resources managed by other security authorities.

Critical Impact
An attacker can compromise the confidentiality, integrity, and availability of data managed by Tanium Comply, with scope extending to adjacent components.

Affected Products

Tanium Comply

Discovery Timeline

2026-09-09 - CVE-2026-87034 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87034

Vulnerability Analysis

The vulnerability is a SQL injection flaw in Tanium Comply, the compliance and vulnerability assessment module of the Tanium platform. Tanium's advisory TAN-2026-042 confirms remediation but does not disclose the specific injection sink. Because the flaw is network-reachable and requires user interaction, exploitation typically follows a social engineering step such as a crafted link or request that triggers the vulnerable query path. Once triggered, the injected SQL executes against the Comply data store, allowing an attacker to read, alter, or destroy compliance data. The changed scope indicates that impact reaches beyond the Comply module into shared data or downstream systems.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. User-supplied input reaches a SQL query without adequate parameterization or input validation, permitting attacker-controlled clauses to alter query semantics.

Attack Vector

An unauthenticated attacker delivers a malicious request to a network-accessible Comply endpoint. The attack requires a legitimate user to perform an action such as clicking a crafted link. When the request reaches the vulnerable parameter, the injected payload executes within the Comply database context and returns or manipulates data outside the intended query.

// No verified proof-of-concept code is available.
// Refer to Tanium Security Advisory TAN-2026-042 for authoritative technical details.

Detection Methods for CVE-2026-87034

Indicators of Compromise

Unexpected SQL keywords such as UNION, SELECT, SLEEP, or -- appearing in HTTP request parameters directed at Tanium Comply endpoints.
Anomalous outbound queries or large result sets originating from the Comply application service account.
Database errors or stack traces logged by Comply following requests from unusual source addresses.

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for SQL metacharacters in requests targeting Comply URLs.
Correlate authentication events with subsequent Comply request patterns to identify user-interaction-driven exploitation.
Baseline normal Comply database query patterns and alert on deviations such as ad-hoc INFORMATION_SCHEMA reads.

Monitoring Recommendations

Forward Comply application, web server, and database logs to a centralized analytics platform for correlation.
Enable database audit logging on tables accessed by the Comply service account.
Monitor Tanium Comply administrative activity for changes to scan definitions, findings, or report exports that follow suspicious HTTP traffic.

How to Mitigate CVE-2026-87034

Immediate Actions Required

Apply the fixed Comply release identified in Tanium Security Advisory TAN-2026-042 to all affected environments.
Restrict network access to the Comply web interface to trusted management networks and administrator workstations.
Review recent Comply and database logs for evidence of injection attempts prior to patch deployment.

Patch Information

Tanium has released a fixed version of Comply that addresses CVE-2026-87034. Refer to Tanium Security Advisory TAN-2026-042 for the specific fixed build numbers, upgrade guidance, and any prerequisite platform updates.

Workarounds

Place a WAF in front of the Comply interface with rules that block common SQL injection payloads until patching completes.
Limit Comply user accounts and enforce phishing-resistant authentication to reduce the likelihood that a user triggers the attack.
Apply least-privilege database permissions to the Comply service account so that any injected query has minimal reach.

bash

# Example: restrict access to Tanium Comply web interface to a trusted management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP