CVE-2026-87037: Tanium Comply Auth Bypass Vulnerability

CVE-2026-87037 Overview

CVE-2026-87037 is an improper access control vulnerability in Tanium Comply. The flaw allows an authenticated user with low privileges to access or modify resources over the network that should be restricted by the application's authorization model. Tanium has addressed the issue in an updated release of Comply. The weakness is classified under CWE-862: Missing Authorization and can affect both confidentiality and integrity of data managed by the Comply module.

Critical Impact
An authenticated attacker on the network can read or alter Comply data outside their authorization scope, undermining compliance reporting integrity.

Affected Products

Tanium Comply (see Tanium Security Advisory TAN-2026-025 for specific affected versions)

Discovery Timeline

2026-09-09 - CVE-2026-87037 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87037

Vulnerability Analysis

The vulnerability results from missing authorization checks in the Tanium Comply module. Comply performs configuration compliance assessments and vulnerability scanning across managed endpoints. When authorization controls are absent on specific functions or resources, an authenticated user can invoke operations reserved for higher-privileged roles. The impact is bounded to limited disclosure and limited modification of data, with no direct effect on availability. Exploitation requires network access to the Comply interface and valid low-privilege credentials, but does not require any user interaction.

Root Cause

The root cause is missing authorization enforcement on server-side operations within Comply, consistent with [CWE-862]. The application relies on client-side or role-derived trust rather than validating that the caller is entitled to perform each requested action on the target resource. Refer to Tanium Security Advisory TAN-2026-025 for the vendor's technical description.

Attack Vector

An attacker authenticates to the Tanium platform with a low-privilege account and issues requests to Comply endpoints that fail to verify authorization. The requests return data or accept state changes that should be restricted to administrators or other higher-privileged roles. Because the attack proceeds over the network with low complexity and no user interaction, exploitation can be scripted against exposed Comply instances.

No public proof-of-concept code has been published. See the vendor advisory for technical specifics.

Detection Methods for CVE-2026-87037

Indicators of Compromise

Comply API or UI requests from low-privilege accounts to administrative endpoints or resources outside their assigned scope.
Unexpected changes to Comply configurations, scan definitions, benchmarks, or exported reports authored by non-administrative users.
Bursts of enumeration-style requests against Comply resource identifiers from a single authenticated session.

Detection Strategies

Correlate Tanium audit logs with role assignments to flag actions performed by accounts that lack the corresponding role permission.
Baseline normal Comply usage per role and alert on deviations, such as read or write access to resources not previously touched by that role.
Ingest Tanium logs into a centralized analytics platform and build rules that flag authorization anomalies and privilege boundary crossings.

Monitoring Recommendations

Enable verbose audit logging for the Comply module and forward logs to your SIEM for retention and correlation.
Monitor for new or modified compliance policies, benchmarks, and scheduled scans, and require change-review approval.
Review authentication logs for the Tanium console to identify unusual session sources or times preceding sensitive Comply actions.

How to Mitigate CVE-2026-87037

Immediate Actions Required

Apply the fixed version of Tanium Comply as identified in Tanium Security Advisory TAN-2026-025.
Audit Tanium role and permission assignments and remove unneeded low-privilege accounts with access to the Comply module.
Rotate credentials for accounts that may have accessed Comply endpoints outside their normal scope.

Patch Information

Tanium has addressed the improper access control issue in Comply. Consult Tanium Security Advisory TAN-2026-025 for the specific fixed release and upgrade guidance. Prioritize patching instances reachable by broad user populations or federated identity sources.

Workarounds

Restrict network access to the Tanium console and Comply endpoints to trusted administrative subnets pending patch deployment.
Reduce the number of accounts with any Comply role assignment until the update is applied.
Increase audit log review frequency to detect abuse of the vulnerable authorization path before remediation completes.