EUVD-2026-111259
GHSA-r4v7-rcvq-hxh7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Comply user
-
DeliveryIssue request to improperly protected Comply function
-
ExploitBypass missing authorization check (CWE-862)
-
ExecutionAccess or alter resources beyond privilege (scope change)
-
ImpactLimited confidentiality/integrity/availability impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged authenticated account on Tanium Comply (CVSS PR:L), network reachability to the Comply service (AV:N), and no user interaction (UI:N). The specific product feature, API, or configuration that exposes the missing authorization check is not described in the available sources. Limiting factors: the attack is not available to fully unauthenticated attackers, carries high attack complexity (AC:H) per the vendor vector, and is bounded to versions below the fixed releases - Comply 2.32 (<2.32.263), 2.35 (<2.35.323), and 2.37 (<2.37.326); upgrading to these or later versions remediates it per the vendor advisory. |
| Impact | This is a moderate-severity, lower-urgency issue rather than an emergency. The vendor-supplied CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L, score 6.0) describes a network-reachable but authenticated (PR:L) flaw with high attack complexity (AC:H) and only low impact across confidentiality, integrity, and availability, albeit with a scope change (S:C). The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', which aligns with the modest impact profile. There is no CISA KEV listing, no EPSS probability was supplied, and the references contain only a vendor advisory and the NVD page - no proof-of-concept or exploit reference is present. Taken together the signals are internally consistent and point to a real but non-urgent, authenticated access-control weakness rather than a widely-exploited critical bug. Note a limitation: the CVSS vector sets AC:H, but the sparse description ('improper access controls') does not explain WHY exploitation is complex - the trigger is not described in the available sources, so the AC:H justification cannot be independently verified. |
| Exploit ScenarioDerived | A low-privileged but authenticated user of Tanium Comply leverages missing authorization checks (CWE-862) to access or act on Comply resources beyond their intended permission level. Because the vector is network-based with a scope change, the unauthorized action may affect components beyond the Comply module itself. No public exploit code or PoC reference is present in the provided data, and the high attack complexity suggests non-trivial preconditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Improper access controls in Tanium Comply allow a low-privileged authenticated network user to reach functionality or data outside their intended permissions, with limited confidentiality, integrity, and availability impact and a scope change. Affected builds are Comply 2.32 before 2.32.263, 2.35 before 2.35.323, and 2.37 before 2.37.326; Tanium has released fixed builds in each branch. No public exploit has been identified at time of analysis, and the vendor's high attack-complexity rating keeps this a moderate-severity, lower-urgency issue.
RemediationAI
Upgrade Tanium Comply to the fixed build for each affected branch: 2.32.263 or later for the 2.32 line, 2.35.323 or later for the 2.35 line, and 2.37.326 or later for the 2.37 line, as documented in Tanium advisory TAN-2026-066 (https://security.tanium.com/TAN-2026-066). The available sources identify vendor-released fixes but do not describe a separate workaround; because exploitation requires a valid low-privileged authenticated account, the vendor's remediation is the upgrade path to the listed fixed versions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tanium Comply is a compliance and configuration-assessment product within the Tanium platform. The flaw is classified as CWE-862 (Missing Authorization), meaning an access-control check is absent on some Comply functionality; the CVE description and available advisory data do not identify the specific feature, API, or configuration involved, so the trigger is not described in the available sources. The vendor vector is AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L, meaning exploitation requires network reachability to the Comply service, a valid low-privileged account, and no user interaction, with high attack complexity; the scope change indicates impact may extend beyond the vulnerable component's security boundary, while confidentiality, integrity, and availability impacts are each limited. The CPE cpe:2.3:a:tanium:comply:*:*:*:*:*:*:*:* covers the affected Comply product line.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Authenticated low-privileged network user (PR:L, AV:N) abuses a missing authorization check affecting other components (S:C) with low C/I/A; AC:H retained as the vendor's unexplained complexity cannot be refuted.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an improper access controls vulnerability in Comply.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB