Tanium Comply CVE-2026-87023

Exploitation requires a valid Tanium account with at least low-level privileges (PR:L per CVSS vector) - this is not an unauthenticated attack. The attacker must have network access to the Tanium Comply service endpoint (AV:N). No user interaction by a third party is needed once authenticated access is established (UI:N). The scope change (S:C) implies that the Comply module runs with sufficient filesystem privileges to reach resources outside its own directory. Limiting factors: organizations enforcing strict role-based access control in Tanium, restricting Comply usage to dedicated compliance operator accounts, reduce the pool of potential attackers. No specific non-default configuration is indicated as required - the vulnerability appears to affect standard deployments of the Comply module.

The CVSS 8.5 score is driven primarily by the scope change (S:C) and high confidentiality impact (C:H), both of which are plausible for a server-side path traversal in a privileged enterprise agent service. PR:L indicates exploitation requires authenticated access to Tanium with at least minimal user privileges, limiting the attack surface compared to fully unauthenticated vectors. AC:L and UI:N mean that once access is obtained, exploitation is straightforward with no user interaction. No KEV listing and no reported POC means active exploitation has not been publicly confirmed, which meaningfully reduces immediate urgency. EPSS data was not provided in the input. The real-world risk is moderate-high for organizations running Tanium Comply: an authenticated insider or compromised low-privilege Tanium account could exfiltrate sensitive files from the Tanium server, potentially including endpoint scan results, credentials, or policy data. The scope change elevating impact beyond the Comply module itself is the most consequential signal and should not be discounted.

An authenticated Tanium user with low-privilege access crafts a request to the Comply module containing a path traversal sequence (e.g., '../../etc/passwd' or equivalent Windows path) as part of a file reference parameter. The server fails to canonicalize the path, resolves the traversal sequence, and returns file contents from outside the intended Comply data directory. No public proof-of-concept exploit code has been identified at time of analysis.