CVE-2026-87035: Tanium Comply Information Disclosure Flaw

CVE-2026-87035 Overview

CVE-2026-87035 is an information disclosure vulnerability in Tanium Comply. Tanium addressed the flaw through a security update documented in advisory TAN-2026-032. The weakness is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

The vulnerability allows an authenticated attacker with low privileges to access sensitive information over the network without user interaction. Confidentiality is impacted, while integrity and availability remain unaffected.

Critical Impact
An authenticated, low-privileged network attacker can retrieve sensitive data from Tanium Comply, potentially exposing configuration details or compliance results useful for follow-on attacks.

Affected Products

Tanium Comply (specific versions listed in vendor advisory TAN-2026-032)

Discovery Timeline

2026-09-09 - CVE-2026-87035 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87035

Vulnerability Analysis

CVE-2026-87035 is an information disclosure weakness in Tanium Comply, the compliance and vulnerability management module of the Tanium platform. The flaw falls under [CWE-200], indicating the application exposes sensitive information to actors who should not have access to it.

An attacker must be authenticated to the application with low privileges to exploit the issue. Exploitation requires network access to the Comply service but no user interaction. Successful exploitation returns data the attacker should not otherwise be able to read.

Tanium's advisory TAN-2026-032 does not publicly detail the disclosed data class. Compliance products typically process scan findings, benchmark configurations, credentials for scan targets, and endpoint inventory. Any of these categories would provide reconnaissance value to an internal attacker.

Root Cause

The root cause is improper authorization or output filtering within a Comply component. A low-privileged authenticated session receives data intended for higher-privileged roles. Refer to the Tanium Security Advisory TAN-2026-032 for the specific component and affected versions.

Attack Vector

The attack vector is network-based. An attacker authenticates to the Tanium console or a Comply-exposed API endpoint using any valid low-privileged account. The attacker then issues requests that return information beyond the account's authorization scope. No social engineering or user interaction is required.

No public proof-of-concept exploit code is available. No verified exploitation code is published; describing the request pattern would be speculative. Consult the vendor advisory for validated technical details.

Detection Methods for CVE-2026-87035

Indicators of Compromise

Unusual volumes of Comply API or console requests originating from low-privileged Tanium user accounts.
Access to Comply resources by accounts that historically only view a limited scope of endpoints or benchmarks.
Authenticated sessions enumerating Comply endpoints, findings, or configuration objects in sequence.

Detection Strategies

Enable and review Tanium audit logs for Comply module access, focusing on read operations by non-administrative roles.
Baseline normal per-user query patterns in Comply and alert on statistical deviations.
Correlate authentication events with API access to identify accounts performing unexpected data retrieval.

Monitoring Recommendations

Forward Tanium server and Comply application logs to a centralized SIEM for retention and correlation.
Monitor account activity for lateral movement following unusual Comply data access.
Track service account usage in Comply and alert when non-service accounts access bulk compliance data.

How to Mitigate CVE-2026-87035

Immediate Actions Required

Apply the patched Comply version referenced in Tanium Security Advisory TAN-2026-032 as soon as change control permits.
Audit all Tanium user accounts and remove or downgrade accounts that no longer require Comply access.
Rotate any credentials or secrets that may have been exposed through the Comply module.

Patch Information

Tanium has released a fix documented in advisory TAN-2026-032. Administrators should review the advisory for the exact fixed version of Comply and upgrade affected deployments. No workaround replaces the vendor patch.

Workarounds

Restrict network access to the Tanium console and Comply APIs to trusted management networks.
Enforce least-privilege role assignments within Tanium and remove unused low-privileged accounts.
Enable multi-factor authentication on all Tanium accounts to raise the cost of credential-based access.

bash

# Configuration example
# Review Tanium user roles and export the list for audit
# Consult Tanium documentation for the exact CLI or API for your version
curl -sk -H "session: $TANIUM_SESSION" \
  "https://tanium.example.com/api/v2/users" \
  | jq '.data[] | {name, role, last_login}'