EUVD-2026-74558
GHSA-jh9j-ccjj-r4xm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Tanium account
-
DeliveryAccess Comply module over network
-
ExploitSend crafted request to restricted operation
-
ExecutionBypass missing authorization check
-
ImpactModify compliance configurations or policy data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid, low-privileged Tanium user account with network access to the Tanium Comply module - the CVSS PR:L metric confirms authenticated access is necessary, but no high-privilege role is required. The vulnerability is present in Comply branches 2.32 (pre-2.32.252), 2.35 (pre-2.35.306), and 2.37 (pre-2.37.308) on network-accessible deployments. No specific non-default configuration is required beyond having a Tanium Comply deployment on an affected version. Exploitation is limited by the authentication prerequisite - unauthenticated external attackers cannot exploit this directly - and by the absence of confidentiality or availability impact, constraining the attack surface to integrity manipulation of compliance data. |
| Impact | The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) reflects a network-reachable, low-complexity authorization flaw requiring only a low-privileged account. The integrity impact is rated High with no confidentiality or availability impact, suggesting the primary risk is unauthorized modification - potentially of compliance policy configurations, scan settings, or benchmark assignments - rather than data exfiltration or service disruption. No EPSS data was provided, and the vulnerability is absent from CISA KEV, which reduces urgency for organizations without low-privileged untrusted users. However, in enterprise environments where Tanium Comply manages security compliance posture, unauthorized modification of compliance data could suppress audit findings or alter remediation tracking, making the business impact higher than the base CVSS suggests. The self-reported nature (Tanium as reporter) and availability of a vendor patch indicate responsible internal discovery rather than external exploitation. |
| Exploit ScenarioDerived | An attacker with a valid low-privileged Tanium account - such as a read-only analyst or a service account used for compliance reporting - sends a crafted network request to the Comply module invoking a restricted operation without triggering an authorization check. This could allow the attacker to alter compliance scan configurations, modify benchmark mappings, or suppress policy findings, undermining the integrity of compliance reporting without any elevated credential or user interaction. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Improper access controls in Tanium Comply allow an authenticated low-privileged network user to perform write operations beyond their authorization level, resulting in high integrity impact. Three active release branches are affected: 2.32, 2.35, and 2.37, each with specific fixed builds released by Tanium under advisory TAN-2026-029. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the network-accessible, low-complexity vector lowers the bar for exploitation by any authenticated user.
RemediationAI
Upgrade Tanium Comply to the fixed builds: 2.32.252 or later for the 2.32 branch, 2.35.306 or later for the 2.35 branch, and 2.37.308 or later for the 2.37 branch, as detailed in Tanium advisory TAN-2026-029 at https://security.tanium.com/TAN-2026-029. If immediate patching is not possible, restrict access to the Tanium Comply module to only fully trusted, explicitly authorized users and remove any low-privileged or service accounts with Comply access until the patch is applied. Note that restricting user access may temporarily reduce operational capacity for compliance workflows. No vendor-published workaround beyond patching is available from the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tanium Comply is the compliance and configuration assessment module within the Tanium unified endpoint management platform, used primarily in enterprise environments for security benchmarking and policy enforcement. The root cause is CWE-862 (Missing Authorization) - the application performs an operation on behalf of an authenticated user without verifying that the user holds sufficient privilege or role to authorize that specific action. This is distinct from authentication bypass; the user is legitimately authenticated but the authorization gate is absent or incomplete for certain operations. The affected CPE is cpe:2.3:a:tanium:comply:*:*:*:*:*:*:*:*, covering all sub-versions below the patched builds across the three tracked branches.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible, low-complexity; PR:L confirmed by authentication requirement; integrity-only impact consistent with authorization bypass on a compliance configuration module.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an improper access controls vulnerability in Comply.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB