EUVD-2026-74547
GHSA-jf2j-839q-ggg6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Comply user
-
DeliveryIdentify or enumerate target object keys
-
ExploitCraft request with victim's object identifier
-
ExecutionSubmit unauthorized modification to Comply API
-
ImpactCompliance record or configuration altered beyond authorized scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires an authenticated session with at least low-level privileges in Tanium Comply - the CVSS vector PR:L confirms authentication is mandatory. No special configuration, non-default settings, or elevated roles are required beyond a valid user account in the system. The attack is network-accessible (AV:N) against any Tanium Comply deployment regardless of branch (2.32, 2.35, or 2.37). Exploitation is limited to integrity modification (I:L); an attacker cannot extract confidential data or cause denial of service. The practical ceiling of impact is manipulation of compliance records or scan settings within the Comply module. |
| Impact | The real-world risk here is moderate despite the low CVSS score of 4.3. The network attack vector with low-privilege authentication and no user interaction makes this straightforward to exploit for any legitimate Tanium Comply user seeking to exceed their authorization. The integrity-only impact (I:L, C:N, A:N) limits the damage - an attacker cannot read sensitive data or crash the system, but they could manipulate compliance records, configuration baselines, or audit results, undermining the integrity of compliance reporting. In regulated environments where Comply output feeds audit and governance workflows, integrity corruption of compliance state carries elevated business risk beyond what the raw CVSS reflects. No KEV listing, no POC, and no EPSS data were provided - exploitation status is unknown but no confirmed active exploitation has been identified. The patch is vendor-confirmed across three version branches, reducing urgency for patched deployments. |
| Exploit ScenarioDerived | An authenticated Tanium Comply user with a low-privileged role crafts API requests substituting object identifiers for resources belonging to another user or a higher-privileged scope. By enumerating or guessing object keys, the attacker submits modifications to compliance records, scan configurations, or benchmark assignments outside their authorized scope, corrupting compliance posture data without triggering authentication failures. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Improper access controls in Tanium Comply allow an authenticated low-privileged user to perform unauthorized write operations they should not be permitted to execute. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application fails to enforce object-level authorization checks, allowing a user to manipulate resource identifiers to access or modify other users' or roles' data. No public exploit has been identified at time of analysis, and EPSS data is not available in the provided intelligence.
RemediationAI
Upgrade Tanium Comply to the fixed releases: 2.32.252 (for deployments on the 2.32 branch), 2.35.306 (for 2.35 branch), or 2.37.308 (for 2.37 branch), per the vendor advisory TAN-2026-035 at https://security.tanium.com/TAN-2026-035. If immediate patching is not possible, restrict access to the Tanium Comply module to only the minimum set of authenticated users required for operations, reducing the population of users who could trigger the access control bypass. Review and audit existing Comply role assignments to confirm no over-provisioned users exist who could exploit this window prior to patching. No workaround eliminates the underlying flaw - patching is the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tanium Comply is a compliance and benchmark assessment module within the Tanium endpoint management platform, used by large enterprises to evaluate and enforce security configuration baselines. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a class of insecure direct object reference (IDOR) flaw where the application uses attacker-controllable values (e.g., record IDs or object keys in API parameters) without validating that the authenticated user has the right to act on the referenced object. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates exploitation is remote, requires no special configuration complexity, and requires only a low-privileged authenticated session, with impact limited to integrity modification. Three distinct version branches are affected per the EUVD entry: 2.32.x, 2.35.x, and 2.37.x.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible IDOR requiring only a valid authenticated session; impact is integrity-only with no confidentiality or availability consequence.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an improper access controls vulnerability in Comply.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB