Tanium Comply CVE-2026-116647

The CVSS vector (PR:N) indicates no authentication is required to introduce the malicious input, but UI:R means a successful attack depends on an authorized user subsequently viewing or exporting the affected Comply output - that user interaction is the primary limiting factor. The scope change (S:C) implies the mishandled output affects a component or trust context beyond the one the attacker directly controls (e.g., the viewing operator's session or an exported artifact). The description only states this is an 'improper output sanitization' issue (CWE-1236) in Comply; the exact feature, injection point, affected output format, and deployment mode are not described in the available sources, so the concrete triggering configuration cannot be confirmed. Further limiters: only Comply versions below the listed fixed builds (2.32.263 / 2.35.323 / 2.37.326) on the respective branches are affected, and impact is bounded (Low confidentiality/integrity/availability).

The CVSS 3.1 base score of 7.1 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) is driven more by the network vector, lack of required privileges, and the scope change (S:C) than by impact, since confidentiality, integrity, and availability are all rated Low. The defining limiter is UI:R - exploitation requires a victim to interact with attacker-influenced output - which pushes this out of the 'wormable/drive-by' category and toward opportunistic or targeted abuse. The vuln.today priority is 'this_week', consistent with a patched, vendor-reported issue that is not an emergency but should not be deferred. There is no KEV listing, so there is no confirmed active exploitation; there is no PoC or exploit reference in the input, so this is no public exploit identified at time of analysis; and no EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified from the data provided. Net: this is a legitimate but moderate-priority, interaction-dependent information-disclosure/output-sanitization issue rather than a high-CVSS-but-trivially-exploitable critical - the 7.1 is inflated somewhat by S:C, while the Low/Low/Low impact triad and mandatory user interaction keep real-world risk moderate.

An attacker places malicious, improperly sanitized content so that it is later rendered or exported by Tanium Comply; when an operator views that output, the unsanitized data is processed in the operator's context, crossing a trust/scope boundary (S:C) to disclose information or perform limited actions. Because the CVSS vector requires user interaction (UI:R), the attack hinges on an authorized user opening or viewing the affected output. No public exploit code or PoC reference is present in the supplied data.