Tanium Comply CVE-2026-87046

Exploitation requires a valid authenticated account in Tanium Comply with at minimum low-privilege credentials (CVSS PR:L). No special non-default configuration is required beyond having any user-level access to the Comply module. The attack is conducted over the network (AV:N) without user interaction or elevated privileges. What limits exploitation: an attacker must possess or obtain Tanium Comply credentials before attempting the authorization bypass; unauthenticated external attackers cannot exploit this vulnerability. Additionally, the impact is constrained to integrity modification (I:L) within the Comply module - no confidentiality breach or availability disruption is possible through this vulnerability alone.

The CVSS 4.3 base score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects a moderate, authenticated-only network vulnerability with bounded impact. Attack complexity is low and no user interaction is required, but the PR:L requirement means a threat actor must first possess valid Tanium Comply credentials before exploitation is possible - this substantially limits the realistic attacker population to insiders, compromised accounts, or post-initial-access lateral movement scenarios. No EPSS data was provided; given the absence of KEV listing and public exploit code, opportunistic exploitation at scale is unlikely. The integrity-only impact (I:L) and no confidentiality exposure mean even a mid-sized enterprise IT team operating in a location like mielec would not face data exfiltration risk, though unauthorized compliance policy modifications could produce audit or regulatory consequences if undetected. The 'Authentication Bypass' tag in the input metadata appears inconsistent with the CVSS PR:L vector - this is an authorization bypass for authenticated users, not a bypass of the authentication mechanism itself.

An authenticated Tanium Comply user with standard low-privilege credentials connects to the Comply web interface over the network and issues requests targeting compliance policies, scan configurations, or data objects that their assigned role should not permit modification of. Due to the flawed authorization check, the server accepts and processes the unauthorized request, allowing the attacker to alter compliance posture records or suppress policy enforcement findings without legitimate authority. No exploit code or proof-of-concept has been publicly documented for this vulnerability.