Tanium Comply EUVD-2026-74554

Exploitation requires an authenticated Tanium Comply session with at minimum a low-privilege user account on the platform - PR:L in the CVSS vector confirms authentication is a prerequisite. The vulnerability is exploitable over the network with low attack complexity and no user interaction required. The access control bypass is conditional on the presence of user-controlled object keys in requests, consistent with CWE-639 IDOR mechanics. Limiting factors include: (1) valid Tanium platform credentials are required - unauthenticated external exploitation is not possible per the CVSS PR:L assignment; (2) impact is scoped to integrity and availability at a low level, with no confidentiality impact per vendor assessment; (3) exploitation is limited to affected release branches (2.32, 2.35, 2.37) below the specified fix thresholds.

The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) reflects a medium-severity, network-exploitable vulnerability requiring only authenticated low-privilege access and no user interaction. The C:N component is notable: for IDOR vulnerabilities, confidentiality impact is commonly present, but the vendor-assigned vector omits it, suggesting exploitation may be limited to modifying or disrupting compliance data rather than reading unauthorized records - though this cannot be independently verified given the terse description. No EPSS score was provided, KEV status is not set, and no public exploit code has been identified, all of which suggest this is not under active mass exploitation. Real-world risk is primarily scoped to insider threat or compromised low-privilege accounts within a Tanium-managed enterprise. Organizations relying on Comply for audit-driven compliance posture reporting face the most meaningful operational risk, as integrity manipulation of compliance scan results could mask non-compliant endpoints.

An authenticated Tanium Comply user with a standard low-privilege role manipulates a resource identifier parameter - such as a compliance scan record ID or policy object key - in an API request to reference a record owned by a different user or scope. The server fails to verify that the requesting account is authorized for that specific object, allowing the attacker to overwrite or disrupt compliance scan results outside their own scope. No public exploit code is known; exploitation requires valid platform credentials.