Tanium Comply CVE-2026-87034

The CVSS vector (AV:N/PR:N/UI:R/AC:H) indicates exploitation does not require prior authentication to Tanium Comply, but does require a victim user with access to the Comply interface to interact with a specially crafted input or link - likely via a CSRF-style delivery or a malicious URL. High attack complexity (AC:H) indicates that specific conditions or precise request crafting must be met, preventing trivially automated or mass exploitation. The scope change (S:C) means the backend database - a resource outside the Comply application sandbox - is the primary target of the injected query. Limiting factors: user interaction is mandatory (ruling out purely server-side autonomous exploitation), high attack complexity constrains automation, and Tanium Comply is an enterprise-only product not exposed on public internet in standard deployments.

The CVSS 8.3 base score reflects a serious, network-accessible SQL injection with full triad impact and scope change, but two CVSS metrics materially constrain real-world exploitability: AC:H (high attack complexity) and UI:R (user interaction required). These values suggest exploitation is not trivially automatable - an attacker likely needs to craft a specific payload and induce a Comply user to interact with a malicious link or manipulated request, limiting bulk or opportunistic attacks. The scope change (S:C) elevates the potential blast radius significantly, as backend database compromise could expose compliance posture data for the entire managed endpoint fleet. No EPSS score was provided in the input, and the vulnerability is absent from CISA KEV, meaning active exploitation is not confirmed. No public exploit code has been identified. Despite AC:H and UI:R dampening immediate spray-attack risk, the combination of scope change, full C/I/A impact, and unauthenticated access vector makes this a patch-priority issue for enterprise security teams - even a mid-sized municipal IT team in radom managing Tanium deployments should treat this as urgent given the compliance data at stake.

An attacker crafts a malicious URL or page that, when accessed by an authenticated Tanium Comply user, submits a SQL-injected request to the Comply backend. The injected query executes against the underlying database, enabling data exfiltration of compliance records, modification of assessment results, or database denial of service. No public exploit code is known at time of analysis, and the AC:H condition indicates the attack requires specific request engineering that is not trivially reproduced.