EUVD-2026-74560
GHSA-qc79-3chv-pjvq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Tanium credentials
-
DeliveryAccess Comply module over network
-
ExploitSend unauthorized action request
-
ExecutionBypass missing authorization check
-
ImpactModify compliance policy or disrupt module availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated Tanium account with at minimum low-privilege access (PR:L per CVSS vector). The flaw is reachable over the network (AV:N) with no user interaction required and no elevated configuration needed. Exploitation is bounded to Tanium Comply deployments on affected versions (2.32.x <2.32.252, 2.35.x <2.35.306, 2.37.x <2.37.308). Confidentiality is not at risk; impact is limited to partial integrity modification (I:L) and partial availability disruption (A:L). External unauthenticated attackers cannot exploit this without first obtaining platform credentials. |
| Impact | The CVSS 5.4 (Medium) score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L reflects a realistic, bounded risk: the flaw is network-exploitable with low complexity but requires a valid authenticated session, and the impact ceiling is limited - no confidentiality exposure, only limited integrity and availability degradation. EPSS data is not available in the provided intelligence, and the vulnerability is neither listed in CISA KEV nor accompanied by a public POC, placing it firmly in the 'patch on normal cycle' rather than 'emergency response' category. The absence of scope change (S:U) and lack of confidentiality impact further constrain real-world damage. Even a mid-sized municipal IT team in koszalin running Tanium should treat this as a routine patching priority rather than a crisis, since exploitation requires existing platform credentials and yields only partial write-path control. No conflicting signals between CVSS vector and description were identified. |
| Exploit ScenarioDerived | An attacker with a valid low-privileged Tanium account sends crafted API or UI requests to Comply endpoints, bypassing the absent authorization checks to modify compliance policy configurations or trigger availability-affecting operations they would not normally be permitted to perform. Since no POC is publicly available, exploitation requires knowledge of the specific unguarded endpoint or action within Comply. The low complexity of the CVSS vector suggests that once the target endpoint is identified, exploitation is straightforward for any authenticated user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Improper access controls in Tanium Comply (CWE-862, Missing Authorization) allow authenticated low-privileged users to perform unauthorized actions affecting the integrity and availability of the compliance module. Three active release branches are affected - 2.32.x, 2.35.x, and 2.37.x - with vendor-issued patches available for each. No active exploitation has been identified and no public proof-of-concept exists at time of analysis.
RemediationAI
Upgrade Tanium Comply to the patched release corresponding to the deployed branch: 2.32.252 for 2.32.x deployments, 2.35.306 for 2.35.x deployments, or 2.37.308 for 2.37.x deployments, per vendor advisory TAN-2026-027 at https://security.tanium.com/TAN-2026-027. If immediate patching is not operationally feasible, restrict access to the Comply module to only explicitly trusted, higher-privileged accounts by tightening Tanium role-based access controls - this reduces the pool of low-privileged users who could exercise the missing authorization paths, though it does not eliminate the underlying flaw. No additional workarounds are specified in the vendor advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tanium Comply is the compliance and vulnerability management module of the Tanium endpoint management platform, used in large enterprise and government environments to enforce security policies and track patch state across endpoints. CWE-862 (Missing Authorization) describes a condition where an authenticated user is not subjected to proper authorization checks before being permitted to execute a sensitive action - distinct from authentication bypass, which concerns identity verification. The affected CPE (cpe:2.3:a:tanium:comply:*:*:*:*:*:*:*:*) spans all variants across the 2.32, 2.35, and 2.37 release lines below their respective patch thresholds. The CVSS vector (AV:N/PR:L) confirms the flaw is reachable over the network by any user holding a valid low-privileged Tanium account, with no special configuration required.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-reachable with low-privilege auth required; no confidentiality impact; limited write and availability disruption align with missing authorization on a subset of actions.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed an improper access controls vulnerability in Comply.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB