Tanium Comply CVE-2026-87072

Exploitation requires a valid Tanium platform user account with at least low-level privileges (PR:L per CVSS vector); unauthenticated external attackers cannot exploit this vulnerability. The Comply module must be deployed and accessible on the target Tanium instance. The attack is delivered over the network (AV:N) with no user interaction required and low attack complexity. The specific Comply feature, API endpoint, or permission boundary containing the missing authorization check is not identified in the available data - the access control deficiency and its exact scope are inferred from the CVSS metrics and CWE-862 classification rather than confirmed by detailed technical disclosure.

At CVSS 7.1, this represents a meaningful but bounded risk: network-reachable, low-complexity exploitation by authenticated low-privileged users with high confidentiality impact and limited write access. The absence of any EPSS data, CISA KEV listing, or public proof-of-concept in the available intelligence suggests exploitation is not currently widespread or commoditized. However, the high confidentiality impact is particularly sensitive in compliance-focused deployments - Comply data routinely includes vulnerability scan results, unpatched system inventories, and policy audit findings that are operationally sensitive and potentially useful for lateral movement planning. The missing authorization vulnerability class is especially concerning in multi-role enterprise environments where role separation is a core security assumption. No conflicting CVSS signals are present, but the description is deliberately vague, and the specific Comply feature or API endpoint affected is not identified beyond the advisory reference.

An attacker holding a low-privilege Tanium user account - such as a department-scoped operator or read-only auditor - sends crafted API or UI requests to the Comply module, bypassing the missing authorization check to access compliance reports, vulnerability scan results, or policy assessment data scoped to higher-privilege roles. The attacker may also make limited unauthorized modifications to compliance records. No public proof-of-concept has been reported, and the specific request structure required is not publicly detailed.