Tanium Comply CVE-2026-87021

Exploitation requires possession of a high-privilege Tanium account (PR:H per CVSS), which must have access to the Comply module and the specific input field or API parameter susceptible to template injection. The attacker must be able to reach the Tanium server's network interface (AV:N), though this is commonly restricted to internal management networks in enterprise deployments. No user interaction by a third party is required once the attacker is authenticated. Exploitation is limited to: actors with valid high-privilege Tanium credentials; network connectivity to the Tanium server; and access to the Comply module specifically. The S:U (no scope change) metric indicates impact is confined to the Comply server process itself rather than pivoting to other systems via the vulnerability directly.

The provided CVSS 3.1 score of 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects a high-privilege-required network attack yielding full-triad impact. The PR:H requirement is the primary risk-mitigating factor: exploitation is limited to actors who have already obtained administrative or equivalent credentials within the Tanium platform, substantially narrowing the realistic attacker population compared to unauthenticated RCE. That said, SSTI vulnerabilities with PR:H can represent a meaningful privilege escalation path - a Tanium operator with administrative UI access but not OS-level access on the Comply server can leverage template injection to execute arbitrary code as the server process, potentially escaping the application's authorization boundary. No EPSS score was provided; given PR:H and the absence of KEV listing or public POC, real-world exploitation likelihood at scale is assessed as low-to-moderate. The primary concern is insider threat or post-compromise lateral movement scenarios. No conflicting CVSS signals identified; the network vector is consistent with a web-based compliance module.

An attacker who has obtained high-privilege Tanium administrator credentials - through credential theft, phishing, or lateral movement from a previously compromised host - authenticates to the Tanium Comply web interface and submits a crafted input containing a template injection payload (e.g., a malicious expression targeting the server-side template engine). The template engine processes the injected directive without adequate sanitization, executing arbitrary OS commands as the Tanium server process and granting the attacker full control over the Comply server. No public proof-of-concept code has been identified at time of analysis.