Tanium Comply CVE-2026-87075

The attacker must hold a valid, authenticated Tanium account with at least low-level privileges (PR:L per CVSS). The Comply module must be installed and accessible over the network. No user interaction or complex setup is required beyond authenticated network access to the Tanium platform. Exploitation is limited to environments where: (1) Tanium Comply is deployed, (2) low-privilege or minimally-trusted user accounts exist, and (3) those accounts have network reachability to the Tanium server. There is no indication of a default-configuration exposure for purely unauthenticated attackers - a valid credential is required.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H scores 8.1 (High). Key risk signals: the attack is network-reachable with low complexity and requires only low-level authenticated access, meaning any valid Tanium user account could be sufficient. The high integrity and availability impact suggests an attacker could modify compliance records, disable policy checks, or disrupt the Comply service. Confidentiality is scored C:N by the vendor, implying data exfiltration is not the primary concern. No EPSS score, KEV listing, or public POC data is available, which limits prioritization signals. The 'Authentication Bypass' tag in the input metadata is inconsistent with the CVSS PR:L vector and CWE-863 root cause - this appears to be a mislabeled authorization bypass rather than a true authentication bypass, and should not inflate perceived severity. Realistic risk is confined to environments running Tanium Comply where untrusted or low-privilege user accounts exist with network access to the platform.

An attacker with a valid low-privilege Tanium user account sends a crafted network request to the Comply module, bypassing authorization checks that should restrict the operation to higher-privileged roles. The attacker is then able to modify compliance policies or assessment configurations, falsifying compliance status across managed endpoints, or triggering actions that disrupt the Comply service availability.