CVE-2026-87036: Tanium Comply Authentication Bypass Flaw

CVE-2026-87036 Overview

CVE-2026-87036 is an improper access control vulnerability in Tanium Comply. Tanium addressed the flaw through a security advisory published as TAN-2026-041. The weakness is categorized under [CWE-862] (Missing Authorization), meaning the application fails to verify that an authenticated user has the required permissions before performing sensitive actions.

The vulnerability is network-exploitable and requires low privileges but no user interaction. Successful exploitation permits an authenticated attacker to compromise the integrity and availability of the Comply module without exposing confidential data directly.

Critical Impact
An authenticated low-privileged user can perform unauthorized actions in Tanium Comply, impacting the integrity and availability of compliance data and scans.

Affected Products

Tanium Comply (see vendor advisory TAN-2026-041 for affected versions)

Discovery Timeline

2026-09-09 - CVE-2026-87036 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87036

Vulnerability Analysis

The vulnerability exists in Tanium Comply, the module that provides configuration compliance and vulnerability assessment across managed endpoints. The application performs sensitive operations without adequately verifying whether the requesting user is authorized to invoke them.

An attacker with valid but low-privileged credentials can send crafted requests over the network to Comply endpoints. Because authorization checks are missing or improperly enforced, the backend executes actions that should be restricted to higher-privileged roles. The impact extends to integrity and availability, indicating that the flaw allows modification or disruption of Comply data and functions rather than direct data exfiltration.

Root Cause

The root cause is a missing authorization check [CWE-862]. The application authenticates the user session but does not consistently enforce role-based access control on protected functions. This gap between authentication and authorization allows privilege boundaries within the Comply module to be crossed.

Attack Vector

Exploitation requires network access to the Tanium Comply interface and valid low-privileged credentials. The attacker issues requests to functionality that should be gated behind stronger role checks. No user interaction and no elevated privileges are required to trigger the flaw.

No public proof-of-concept exploit code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Tanium Security Advisory TAN-2026-041 for vendor-supplied technical details.

Detection Methods for CVE-2026-87036

Indicators of Compromise

Unexpected modification, creation, or deletion of Comply policies, scans, or reports by non-administrative accounts.
HTTP requests from low-privileged sessions to Comply administrative API endpoints.
Anomalous spikes in Comply configuration changes originating from a single user or session token.

Detection Strategies

Audit Tanium Comply application logs for authorization-relevant events performed by accounts that lack the corresponding role.
Correlate user role assignments with the actions each user performs against Comply endpoints to surface privilege mismatches.
Monitor for lateral or vertical privilege escalation patterns following authentication events on the Tanium server.

Monitoring Recommendations

Forward Tanium server and Comply module logs to a centralized SIEM for retention and correlation.
Alert on any Comply administrative action executed outside of maintenance windows or by non-admin accounts.
Review authentication logs for credential compromise indicators such as impossible-travel or brute-force patterns targeting Comply users.

How to Mitigate CVE-2026-87036

Immediate Actions Required

Apply the fixed version of Tanium Comply as documented in the vendor advisory TAN-2026-041.
Inventory all Tanium Comply deployments and confirm patch status across production and non-production environments.
Review Comply user roles and remove unnecessary low-privileged accounts that could be leveraged for exploitation.

Patch Information

Tanium has addressed CVE-2026-87036 in an updated release of the Comply module. Consult the Tanium Security Advisory TAN-2026-041 for the specific fixed version numbers and upgrade procedures.

Workarounds

Restrict network access to the Tanium server and Comply endpoints to trusted administrative networks only.
Enforce multi-factor authentication on all Tanium user accounts to raise the barrier for credential-based access.
Reduce the number of accounts with any Comply access until the patch is deployed, following least-privilege principles.

bash

# Configuration example
# Review current Tanium Comply user role assignments and audit recent activity.
# Consult TAN-2026-041 for vendor-specific upgrade commands.