EUVD-2026-74545
GHSA-6h5p-xfhp-cv58
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege Tanium credentials
-
ExploitSend crafted Comply API request
-
ExecutionBypass missing authorization check
-
ImpactRead or modify compliance data beyond authorized scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid Tanium account with at least low-level privileges (PR:L per CVSS). The vulnerability is network-accessible (AV:N) against the Tanium server over the organization's standard management network, requiring no user interaction and no special configuration beyond having a functional Tanium Comply deployment. Limiting factors: the attacker must already possess valid Tanium credentials, and impact is bounded to confidentiality and integrity of Comply module data (C:L/I:L) - there is no code execution or availability impact. Organizations that tightly control Tanium account provisioning and enforce least-privilege RBAC significantly reduce realistic exposure. |
| Impact | The CVSS 5.4 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects a realistic assessment: a network-accessible flaw requiring only a low-privilege authenticated account, with limited confidentiality and integrity impact and no availability impact. The absence of scope change (S:U) indicates the vulnerability is bounded within the Comply module rather than pivoting to the broader Tanium platform. No public exploit code exists and the vulnerability is not in CISA KEV, which substantially lowers real-world urgency for most organizations. However, Tanium deployments typically contain sensitive endpoint compliance posture data, so even C:L/I:L access by an unauthorized principal could expose policy gap details or allow manipulation of compliance reporting results. The primary real-world risk is insider threat or compromised low-privilege accounts exfiltrating compliance findings or falsifying assessment results. |
| Exploit ScenarioDerived | An attacker with a valid low-privilege Tanium account - for example a read-only reporting user - sends a crafted API or UI request to a Comply endpoint that lacks a server-side authorization check. The request succeeds and the attacker retrieves compliance assessment data for endpoints outside their authorized scope, or modifies a compliance result to falsify an organization's policy adherence posture. No public exploit code is required; the vulnerability is exploitable through normal Tanium Comply API interactions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Improper access controls in Tanium Comply (CWE-862 Missing Authorization) allow authenticated low-privilege users to perform actions or access data beyond their authorized scope. Three active release branches are affected: 2.32, 2.35, and 2.37. No public exploit code and no CISA KEV listing have been identified at time of analysis; Tanium has released patched builds across all affected branches.
RemediationAI
Upgrade Tanium Comply to the fixed builds as specified in Tanium advisory TAN-2026-025: 2.37.308 or later for the 2.37 branch, 2.32.252 or later for the 2.32 branch, and 2.35.306 or later for the 2.35 branch. The advisory is available at https://security.tanium.com/TAN-2026-025. If immediate patching is not possible, restrict Tanium Comply access to only those user accounts that operationally require it using Tanium's role-based access control (RBAC) features, and audit existing Comply-scoped roles to minimize low-privilege account exposure. Review Comply access logs for anomalous query or reporting activity by low-privilege accounts as a compensating detective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tanium Comply is a compliance assessment and reporting module within the Tanium endpoint management platform, used by enterprises to benchmark endpoints against policy frameworks such as CIS and STIG. CWE-862 (Missing Authorization) indicates that one or more operations within Comply fail to verify whether the authenticated requesting principal holds sufficient authorization before executing the requested action. This is distinct from authentication bypass: the CVSS PR:L metric confirms that a valid credential is required, but authorization gates protecting specific Comply functions are absent or incomplete. The affected CPE is cpe:2.3:a:tanium:comply:*:*:*:*:*:*:*:*, spanning multiple minor release lines.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Authenticated low-privilege network access required; limited read/write impact within Comply module only; no availability impact or scope change.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an improper access controls vulnerability in Comply.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB