CVE-2026-87075: Tanium Comply Auth Bypass Vulnerability

CVE-2026-87075 Overview

CVE-2026-87075 is an improper access controls vulnerability in Tanium Comply. The flaw falls under [CWE-863] Incorrect Authorization, allowing an authenticated attacker with low privileges to perform actions beyond their intended permission scope. Successful exploitation impacts integrity and availability of the Comply module without requiring user interaction. Tanium has published Security Advisory TAN-2026-037 acknowledging and addressing the issue. The vulnerability is remotely exploitable over the network and does not require elevated privileges to trigger.

Critical Impact
An authenticated network-based attacker can bypass authorization checks in Tanium Comply to modify or disrupt compliance data and operations.

Affected Products

Tanium Comply (see Tanium Security Advisory TAN-2026-037 for affected versions)
Tanium platform deployments running the Comply module
Refer to vendor advisory for specific version boundaries

Discovery Timeline

2026-09-09 - CVE CVE-2026-87075 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87075

Vulnerability Analysis

The vulnerability resides in the authorization logic of the Tanium Comply module, which manages compliance assessments and reporting. Comply enforces role-based access controls to restrict who may configure assessments, view findings, and modify compliance policies. The improper access control defect allows an authenticated user with limited privileges to invoke functions or endpoints reserved for higher-privileged roles. Because the attack vector is network-based and requires only low privileges, any user with valid Tanium credentials can attempt exploitation.

The impact profile shows no confidentiality loss, but high impact to integrity and availability. This indicates the attacker can alter compliance data, modify configurations, or disrupt module operations without necessarily reading protected data. In a compliance context, integrity loss is particularly consequential because falsified compliance results can mask regulatory drift and misconfigurations.

Root Cause

The root cause is classified as [CWE-863] Incorrect Authorization. The Comply module performs authentication but fails to correctly enforce authorization checks on certain actions. Specific technical details are restricted to the Tanium advisory TAN-2026-037 and are not disclosed publicly to limit exploitation risk.

Attack Vector

An attacker requires network reachability to the Tanium console and valid low-privileged credentials. After authenticating, the attacker sends crafted requests to Comply endpoints that lack proper authorization enforcement. No user interaction is required, and the attack complexity is low. Public proof-of-concept code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is available. See the Tanium Security Advisory TAN-2026-037 for vendor-provided technical details.

Detection Methods for CVE-2026-87075

Indicators of Compromise

Unexpected changes to Comply assessments, policies, or scan configurations performed by low-privileged accounts
Audit log entries showing successful actions on Comply endpoints by users whose roles should not permit them
Anomalous API calls to Comply module endpoints outside normal administrator activity windows

Detection Strategies

Review Tanium audit logs for authorization anomalies where user role does not match the action performed
Correlate authentication events with subsequent privileged actions in the Comply module
Alert on non-administrator accounts invoking configuration or policy modification endpoints in Comply

Monitoring Recommendations

Forward Tanium audit and access logs to a centralized SIEM for continuous inspection
Baseline normal Comply user activity and alert on deviations by role
Monitor for repeated failed and successful authorization attempts against sensitive Comply endpoints

How to Mitigate CVE-2026-87075

Immediate Actions Required

Apply the fixed version of Tanium Comply as documented in Tanium Security Advisory TAN-2026-037
Audit existing Comply user accounts and remove unnecessary or dormant low-privileged accounts
Rotate credentials for any accounts suspected of misuse prior to patching
Review recent Comply configuration and policy changes for signs of tampering

Patch Information

Tanium has released updates addressing this vulnerability. Consult the Tanium Security Advisory TAN-2026-037 for the fixed Comply version and upgrade guidance. Apply the patch across all affected Tanium environments following standard change control procedures.

Workarounds

Restrict network access to the Tanium console to trusted administrative networks and jump hosts
Enforce least-privilege role assignments and remove Comply access from users who do not require it
Enable multi-factor authentication for all Tanium accounts to raise the barrier for credential-based attacks
Increase audit log retention and review cadence until the patch is fully deployed

bash

# Configuration example
# Refer to Tanium Security Advisory TAN-2026-037 for exact upgrade steps
# General guidance: verify current Comply version, back up configuration, then apply the vendor-provided update package