Tanium Comply CVE-2026-87036

Exploitation requires a valid Tanium Comply account with at least low-level platform privileges (CVSS PR:L); unauthenticated external attackers cannot exploit this flaw directly. No specific non-default configuration, feature flag, or deployment variant is documented as a prerequisite in the available data. Limiting factors include the authentication requirement - which blocks purely external attackers without credentials - and the zero confidentiality impact, confirming the flaw enables write and disruptive actions rather than data theft. Organizations that enforce strict role-based access control and limit Comply access to a small, trusted user population face materially lower risk.

The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) describes straightforward, low-complexity exploitation by any valid Tanium account holder with no user interaction required. The high integrity and availability impacts alongside zero confidentiality impact are consistent with a missing authorization flaw that permits unauthorized write or administrative operations rather than data exfiltration. No EPSS score is present in the provided data, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed broad exploitation campaign. The absence of referenced POC code further reduces immediate opportunistic risk. Even so, the low attack complexity and lack of user interaction mean that even a mid-sized enterprise IT operation reliant on Comply for compliance data integrity should treat this as an urgent remediation priority, as a malicious insider or any compromised low-privilege credential can trigger significant integrity or availability damage without further escalation.

An attacker holding a valid but low-privileged Tanium Comply account - such as a read-only compliance analyst, an over-provisioned service account, or a credential obtained via phishing - sends crafted API requests targeting restricted administrative or configuration endpoints. Because the missing authorization check does not verify the caller's privilege level, the requests succeed, allowing the attacker to alter compliance baselines, delete audit records, or disrupt the Comply service without any interaction from other users.