CVE-2026-87073: Tanium Comply Auth Bypass Vulnerability

CVE-2026-87073 Overview

CVE-2026-87073 is an improper access control vulnerability in Tanium Comply. The flaw allows an authenticated attacker with low privileges to perform actions that should be restricted, resulting in unauthorized modification of protected resources. Tanium has published Security Advisory TAN-2026-029 addressing the issue.

The weakness is classified under [CWE-862] Missing Authorization. Exploitation requires network access and valid low-privilege credentials but no user interaction. The impact is limited to integrity, with no direct effect on confidentiality or availability.

Critical Impact
An authenticated attacker can modify data or configurations within Tanium Comply without holding the required authorization, undermining compliance workflows and reporting integrity.

Affected Products

Tanium Comply (see Tanium Security Advisory TAN-2026-029 for affected versions)

Discovery Timeline

2026-09-09 - CVE CVE-2026-87073 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87073

Vulnerability Analysis

CVE-2026-87073 stems from missing authorization checks in Tanium Comply. Comply is the module Tanium customers use to assess endpoints against configuration and vulnerability benchmarks. When authorization is not enforced consistently across API endpoints or user actions, a lower-privileged user can invoke functionality reserved for higher-privileged roles.

The advisory categorizes the flaw as improper access controls, aligning with [CWE-862] Missing Authorization. The impact profile shows no confidentiality or availability effect, meaning the abused operations write or modify data rather than read sensitive content or crash the service. In a compliance product, unauthorized integrity changes are consequential because tampered scan definitions, exemptions, or results can mask real posture problems.

Root Cause

The root cause is an authorization gap in Comply where the application performs an action based on authentication alone without validating that the requesting principal holds the role or permission required for the operation. See the Tanium Security Advisory TAN-2026-029 for vendor-specific technical detail.

Attack Vector

Exploitation is network-based against the Tanium console or its underlying API. An attacker must first authenticate as a low-privilege Comply user. Once authenticated, the attacker issues requests to endpoints or workflows that lack proper role checks, altering objects such as compliance content, exemptions, or scan configurations that they should not be able to modify.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.174%.

Detection Methods for CVE-2026-87073

Indicators of Compromise

Compliance content, benchmarks, or exemptions modified by user accounts that do not hold administrative Comply roles.
Audit log entries showing API calls to Comply administrative endpoints originating from low-privilege service or operator accounts.
Unexpected changes to scan schedules, report definitions, or remediation workflows without a corresponding change ticket.

Detection Strategies

Review Tanium audit logs for write operations against Comply objects and correlate the acting user's assigned role with the operation performed.
Baseline the set of accounts that legitimately administer Comply, then alert on any deviation.
Compare current Comply configuration state against a known-good export to identify unauthorized drift.

Monitoring Recommendations

Forward Tanium audit and access logs to a centralized SIEM or data lake for retention and correlation.
Alert on privilege-sensitive Comply API paths invoked by non-admin principals.
Track authentication anomalies for Comply accounts, including new source addresses and off-hours access.

How to Mitigate CVE-2026-87073

Immediate Actions Required

Apply the fixed Comply version identified in Tanium Security Advisory TAN-2026-029.
Inventory all Tanium Comply user and service accounts and remove entitlements that are not required.
Rotate credentials for any low-privilege Comply accounts suspected of misuse.

Patch Information

Tanium addressed the vulnerability in an updated release of Comply. Refer to Tanium Security Advisory TAN-2026-029 for the specific fixed version and upgrade guidance. Deploy the vendor-supplied patch to all Tanium servers running the affected Comply module.

Workarounds

Restrict Comply console and API access to administrative networks using network segmentation and firewall rules.
Enforce least-privilege role assignments and remove standing access from users who do not require Comply administration.
Enable multi-factor authentication for all Tanium console users to raise the cost of credential-based access.

bash

# Configuration example
# Review Comply role assignments and export audit history for change review
# (Consult Tanium documentation for exact CLI or API paths in your version)
tanium-console user list --module comply
tanium-console audit export --module comply --since 30d --out comply_audit.json