Tanium Comply CVE-2026-87035

Exploitation requires a valid Tanium session with at least low-level platform privileges (confirmed by PR:L in the CVSS vector). The Comply module must be deployed and reachable over the network. No special configuration or elevated role is needed beyond basic Tanium authentication. Unauthenticated external attackers cannot exploit this directly; the authentication prerequisite is the primary limiting factor. The disclosed information is scoped to whatever compliance data the Comply module holds (endpoint posture, audit logs, policy state), not broader platform credentials.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately reflects the constrained nature of this flaw: network-reachable, low complexity, but gated behind authenticated access and yielding only limited confidentiality impact. No EPSS data was provided, and the absence of a KEV listing or POC further supports a low real-world exploitation urgency. The scope is unscoped (S:U) with no integrity or availability impact, making this a contained insider or low-privilege threat rather than an externally weaponizable vulnerability. The primary realistic risk is a legitimately authenticated Tanium user accessing compliance data - endpoint configurations, audit results, or policy details - outside their intended role boundary. This is a genuine but low-priority finding for most organizations, appropriate for scheduled patching rather than emergency response.

An authenticated Tanium user with minimal platform privileges submits a crafted request to the Comply module over the network, receiving compliance data - such as endpoint audit results or policy configuration details - that their role should not permit them to see. No public exploit code exists at the time of analysis, and the low complexity means any authenticated insider could replicate this without specialized tooling.