CVE-2026-87072: Tanium Comply Auth Bypass Vulnerability

CVE-2026-87072 Overview

CVE-2026-87072 is an improper access control vulnerability in Tanium Comply. The flaw permits an authenticated attacker with low privileges to access resources or perform actions beyond the scope of their assigned role. The weakness maps to [CWE-862] Missing Authorization, indicating that the affected component does not verify that a caller is authorized before executing a sensitive operation.

Tanium published advisory TAN-2026-030 describing the issue and providing remediation guidance. The vulnerability is exploitable over the network and requires low attack complexity, but assumes prior authentication to the Tanium platform.

Critical Impact
An authenticated user with limited privileges can read sensitive Comply data outside their authorization scope and perform limited modifications, undermining role-based access boundaries within the Tanium platform.

Affected Products

Tanium Comply (module of the Tanium platform)
Refer to Tanium Security Advisory TAN-2026-030 for affected versions
Deployments where Comply is enabled and accessible to non-administrative users

Discovery Timeline

2026-09-09 - CVE-2026-87072 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-87072

Vulnerability Analysis

The vulnerability resides in the Tanium Comply module, which performs compliance and vulnerability assessment across managed endpoints. Comply exposes functionality through the Tanium console and associated APIs. According to the vendor advisory, authorization checks are missing on one or more code paths, allowing an authenticated user to interact with data or operations that the role model was intended to restrict.

Because the flaw is classified under [CWE-862] Missing Authorization, the affected endpoints likely rely on presence of a valid session rather than explicit role or object-level permission verification. An attacker with any authenticated Comply user context can therefore reach protected resources.

The practical impact centers on confidentiality of compliance data, which may include host inventories, benchmark results, and vulnerability findings. Integrity is affected to a limited degree, and availability is not impacted. This aligns with a scenario where an attacker reads privileged data and can perform some state changes but cannot disable the service.

Root Cause

The root cause is a missing or incomplete server-side authorization decision on Comply resources. The application authenticates the caller but does not consistently verify that the caller's role or ownership permits the requested action. Consult Tanium Security Advisory TAN-2026-030 for the precise component and fixed versions.

Attack Vector

Exploitation requires network reachability to the Tanium server and valid low-privilege credentials. An attacker authenticates to the platform, then issues requests to Comply endpoints that should be restricted to higher-privileged roles. Because attack complexity is low and no user interaction is required, a compromised low-tier account or an insider can trigger the flaw reliably.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No verified exploitation code is available; refer to the vendor advisory for technical details.

Detection Methods for CVE-2026-87072

Indicators of Compromise

Access to Comply API endpoints or console views from user accounts whose role does not include Comply administration
Unexpected export, download, or enumeration of compliance findings, scan results, or benchmark data by low-privilege users
Session or API token activity originating from accounts that historically do not interact with Comply

Detection Strategies

Review Tanium audit logs for Comply-related actions performed by users outside the designated Comply administrator group
Correlate authentication events with subsequent Comply API calls to identify privilege boundary violations
Baseline normal Comply usage per role and alert on deviations, particularly bulk reads of compliance data

Monitoring Recommendations

Forward Tanium server and Comply module logs to a centralized SIEM or data lake for retention and correlation
Enable alerting on administrative actions in Comply that originate from non-administrative role assignments
Track changes to Comply role membership and permissions to detect unauthorized privilege modifications

How to Mitigate CVE-2026-87072

Immediate Actions Required

Apply the fixed Comply version identified in Tanium Security Advisory TAN-2026-030 as soon as maintenance windows allow
Audit all Tanium user accounts and remove or downgrade accounts that do not require Comply access
Rotate credentials and API tokens for accounts that may have accessed Comply during the exposure window

Patch Information

Tanium has released updated Comply builds that enforce the required authorization checks. Administrators should consult Tanium Security Advisory TAN-2026-030 for exact fixed version numbers, upgrade prerequisites, and any post-upgrade validation steps.

Workarounds

Restrict network access to the Tanium console and API to trusted administrative networks until patching is complete
Temporarily reduce the number of user accounts with any Comply role assignment to limit the exploitable population
Increase audit log retention and review frequency for Comply activity while remediation is in progress

For technical details, refer to Tanium Security Advisory TAN-2026-030.