CVE-2026-87048: Tanium Comply Auth Bypass Vulnerability

CVE-2026-87048 Overview

CVE-2026-87048 is an improper access control vulnerability in Tanium Comply. The flaw stems from a missing authorization check [CWE-862] that allows an authenticated low-privileged user to perform actions or access resources beyond their intended permissions. Tanium has addressed the issue and published details in security advisory TAN-2026-027.

The vulnerability requires network access and low privileges without user interaction. Successful exploitation can lead to limited impacts on integrity and availability, though confidentiality remains unaffected based on the published CVSS metrics.

Critical Impact
An authenticated attacker with low privileges can bypass access controls in Tanium Comply to modify data or disrupt functionality that should require higher permissions.

Affected Products

Tanium Comply (specific affected versions listed in Tanium advisory TAN-2026-027)

Discovery Timeline

2026-09-09 - CVE CVE-2026-87048 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87048

Vulnerability Analysis

The vulnerability is classified under [CWE-862] Missing Authorization. Tanium Comply fails to enforce authorization checks on one or more functions or resources. An authenticated user with low privileges can invoke actions or reach data that the application's access model does not intend to expose to that role.

The attack vector is network-based and requires low complexity. No user interaction is needed for exploitation. The impact is limited to integrity and availability, meaning an attacker can alter or disrupt certain resources without exposing confidential data. Refer to the Tanium Security Advisory TAN-2026-027 for product-specific technical details and fixed versions.

Root Cause

The root cause is a missing or insufficient authorization check on a Comply feature or API endpoint. When the application processes a request from an authenticated user, it does not verify that the caller holds the role or permission required for the operation. This gap allows the caller to escalate the operational scope of an existing low-privileged session.

Attack Vector

An attacker must first authenticate to the Tanium environment with a low-privileged account. From there, the attacker sends crafted requests directly to the affected Comply function over the network. Because the request-handling logic does not validate authorization, the request proceeds and modifies data or affects service availability within the intended scope of the flaw.

No verified proof-of-concept code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-87048

Indicators of Compromise

Unexpected Comply configuration changes performed by user accounts that do not typically hold administrative Comply roles.
API requests to Comply endpoints from low-privileged accounts that succeed where prior authorization denials would be expected.
Anomalous spikes in Comply job creation, modification, or deletion from non-administrative sessions.

Detection Strategies

Review Tanium audit logs for actions performed against Comply that do not correlate with the acting user's assigned role.
Correlate authentication events with subsequent Comply API calls to identify low-privileged sessions performing privileged operations.
Baseline normal Comply usage per role and alert on deviations, such as low-privileged accounts touching compliance policies or scans.

Monitoring Recommendations

Forward Tanium audit and application logs to a centralized SIEM for continuous correlation.
Enable alerts on privilege-sensitive Comply actions such as policy edits, scan configuration changes, and report exports.
Track authentication anomalies including new source IPs, off-hours logins, and rapid session enumeration against Comply endpoints.

How to Mitigate CVE-2026-87048

Immediate Actions Required

Apply the fixed version of Tanium Comply as documented in Tanium Security Advisory TAN-2026-027.
Audit existing Comply user roles and remove unnecessary low-privileged accounts that have network access to the Comply console or API.
Rotate credentials for any account observed performing anomalous Comply actions during the exposure window.

Patch Information

Tanium has addressed the improper access controls vulnerability in Comply. Consult the vendor advisory Tanium Security Advisory TAN-2026-027 for the specific fixed versions and upgrade guidance applicable to your deployment.

Workarounds

Restrict network access to the Tanium Comply management interface to trusted administrative networks only.
Enforce least privilege by minimizing the number of accounts with any Comply role until the patch is applied.
Increase audit logging verbosity on Comply and review logs frequently until the environment is fully patched.

bash

# Configuration example
# Verify installed Tanium Comply version against advisory TAN-2026-027
# and consult vendor documentation for upgrade procedures.