Tanium Comply CVE-2026-87030

Exploitation requires a valid Tanium Comply user account with at minimum low-privilege access (PR:L per the CVSS vector); unauthenticated exploitation is not supported by the available data. No elevated administrative credentials are required. The attack is conducted over the network (AV:N) with no special network positioning, and no user interaction is needed (UI:N), making it automatable once credentials are available. No non-default configuration prerequisite is described in the available data. The primary limiting factor for defenders is the credential requirement: tightly controlling who holds Tanium Comply accounts directly constrains the exposed attack surface.

The CVSS 8.5 (High) score is driven primarily by the scope change and high integrity impact rather than confidentiality exposure, which is rated None. The network attack vector (AV:N) and low complexity (AC:L) mean the vulnerability is straightforward to reach from any network-adjacent position with valid credentials. The PR:L prerequisite - a low-privilege Tanium Comply account - is the primary gating factor and is meaningful: attackers must first obtain authenticated access. The S:C/I:H pairing is the most consequential element, as it implies writes can reach host-level paths rather than being confined to Comply's working directory, opening pathways to configuration tampering, injecting web shells, or overwriting binaries. Availability impact is rated Low (A:L), suggesting partial disruption is plausible from malformed writes but full service loss is not the primary scenario. No EPSS probability data, CISA KEV listing, or public proof-of-concept code was present in the input, so exploitation probability cannot be quantified independently - the risk assessment rests on the CVSS vector alone. The wildcard CPE version range suggests Tanium has not disclosed a specific vulnerable version boundary, which complicates scoping for defenders who need to verify patch applicability across their fleet.

An attacker with a valid low-privilege Tanium Comply account sends a crafted HTTP request to a file-handling endpoint, embedding path-traversal sequences in a filename or path parameter. The application fails to canonicalize or restrict the resolved path, allowing the attacker to write a file - such as a web shell or a malicious configuration override - to a directory on the host outside Comply's intended working directory. If the Comply service runs with elevated host-level privileges, this write may be sufficient to achieve persistent code execution on the Tanium server.