CVE-2026-87046: Tanium Comply Auth Bypass Vulnerability

CVE-2026-87046 Overview

CVE-2026-87046 is an improper access controls vulnerability affecting Tanium Comply. The flaw maps to CWE-863: Incorrect Authorization and allows an authenticated network attacker with low privileges to perform actions that should be restricted. Tanium has addressed the vulnerability and published details in security advisory TAN-2026-026.

The issue enables limited integrity impact without requiring user interaction. Confidentiality and availability are not affected, and no exploit code is publicly available at this time.

Critical Impact
An authenticated user with low privileges can bypass authorization checks in Tanium Comply over the network, resulting in unauthorized modification of data within the scope of the vulnerable component.

Affected Products

Tanium Comply (specific affected versions listed in Tanium Security Advisory TAN-2026-026)

Discovery Timeline

2026-09-09 - CVE-2026-87046 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87046

Vulnerability Analysis

CVE-2026-87046 is an authorization flaw in Tanium Comply, the compliance and vulnerability assessment module of the Tanium platform. The vulnerability falls under CWE-863: Incorrect Authorization, indicating that the product performs an authorization check but the check is not implemented correctly.

An attacker with valid low-privilege credentials can send crafted requests over the network to reach functionality or data that authorization logic should have blocked. The impact is limited to integrity, meaning the attacker can modify a subset of resources but cannot read protected data or disrupt service availability.

Root Cause

The root cause is an improper access control decision within Tanium Comply. The application accepts authenticated requests and evaluates permissions, but the evaluation does not fully enforce the intended authorization boundary. Full technical specifics are documented by the vendor in TAN-2026-026.

Attack Vector

Exploitation requires network access to a Tanium Comply instance and valid credentials for a low-privilege account. No user interaction is required, and attack complexity is low. A successful request causes the server to perform an action or accept data that the authenticated principal is not authorized to submit.

No public proof-of-concept code has been released. The vulnerability mechanism is described in the vendor advisory; see Tanium Security Advisory TAN-2026-026 for details.

Detection Methods for CVE-2026-87046

Indicators of Compromise

Unexpected modification of Comply configurations, compliance policies, or scan definitions performed by low-privilege user accounts.
Authenticated API requests to Comply endpoints from accounts whose role does not normally interact with those resources.
Audit log entries showing successful state-changing operations that do not correspond to a change ticket or scheduled workflow.

Detection Strategies

Review Tanium Comply audit logs for state-changing operations performed by non-administrative roles.
Correlate authentication events with subsequent Comply API calls to identify accounts operating outside expected patterns.
Baseline normal Comply usage per role and alert on deviations, particularly write operations from read-only or restricted accounts.

Monitoring Recommendations

Forward Tanium Comply application and audit logs to a centralized SIEM for correlation with identity events.
Enable alerting on failed and successful authorization decisions on privileged Comply endpoints.
Monitor for anomalous role usage and privilege changes on Tanium Comply user accounts.

How to Mitigate CVE-2026-87046

Immediate Actions Required

Apply the fixed release of Tanium Comply as identified in Tanium Security Advisory TAN-2026-026.
Inventory all Tanium Comply deployments and confirm the running version against the vendor's fixed version list.
Review Comply user roles and remove unnecessary low-privilege accounts that could be used to reach the vulnerable code path.

Patch Information

Tanium has addressed CVE-2026-87046 in an updated release of Comply. Refer to Tanium Security Advisory TAN-2026-026 for the exact fixed versions, upgrade procedures, and vendor guidance. Apply the patch through the standard Tanium module update workflow.

Workarounds

Restrict network access to the Tanium Comply management interface to trusted administrative networks only.
Enforce least privilege on Comply roles and audit permission assignments to limit accounts that can reach the affected endpoints.
Enable multi-factor authentication on all Tanium user accounts to reduce the risk of credential-based access by an attacker.