Comply
Monthly
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to perform unauthorized actions, producing high integrity and availability impact across the platform. Tanium disclosed this vulnerability via advisory TAN-2026-041; the CVSS 8.1 score reflects network-reachable exploitation requiring only a valid low-privilege account with no user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Server-side template injection (SSTI) in Tanium Comply enables remote code execution by a highly privileged authenticated user, yielding full confidentiality, integrity, and availability impact on the Comply server. The vulnerability (CWE-1336) results from insufficient neutralization of template directives in user-controlled input, allowing the underlying template engine to evaluate and execute injected payloads server-side. Tanium addressed this in advisory TAN-2026-040; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's intended directory scope, resulting in high confidentiality impact and scope change to the broader host system. The CVSS vector (S:C, C:H) indicates the traversal can reach resources beyond the Comply component itself, potentially exposing sensitive configuration, credentials, or endpoint compliance data accessible to the Tanium platform. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user interaction and high attack complexity - to execute arbitrary SQL against the backend database, with a scope change that extends impact beyond the Comply application itself to C:H/I:H/A:H. Tanium addressed this in advisory TAN-2026-042. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Improper access controls (CWE-862 Missing Authorization) in Tanium Comply expose compliance and vulnerability assessment data to authenticated users who lack sufficient privileges to access it. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) scores this at 7.1, with high confidentiality impact and limited integrity risk, exploitable over the network by any low-privileged Tanium account holder with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write against the underlying host. The CVSS vector (AV:N/AC:L/PR:L/S:C/I:H) confirms the vulnerability is network-reachable without administrative credentials and breaks containment boundaries beyond the Comply module itself. Tanium addressed the issue under advisory TAN-2026-043; no public exploit code or CISA KEV listing is currently identified.
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations with high integrity and availability impact over the network. Exploiting this CWE-863 (Incorrect Authorization) flaw, an attacker with minimal authenticated access can bypass authorization enforcement within the Comply module, potentially altering compliance posture data or disrupting compliance workflows. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed.
Improper access controls in Tanium Comply (CWE-862, Missing Authorization) allow authenticated low-privileged users to perform unauthorized actions affecting the integrity and availability of the compliance module. Three active release branches are affected - 2.32.x, 2.35.x, and 2.37.x - with vendor-issued patches available for each. No active exploitation has been identified and no public proof-of-concept exists at time of analysis.
Improper access controls in Tanium Comply allow an authenticated low-privileged network user to perform write operations beyond their authorization level, resulting in high integrity impact. Three active release branches are affected: 2.32, 2.35, and 2.37, each with specific fixed builds released by Tanium under advisory TAN-2026-029. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the network-accessible, low-complexity vector lowers the bar for exploitation by any authenticated user.
Information disclosure in Tanium Comply allows authenticated low-privilege network users to access data beyond their authorization level. Versions in the 2.37 branch prior to 2.37.308 are confirmed affected per the EUVD advisory tied to vendor bulletin TAN-2026-032. No public exploit code or active exploitation has been identified; Tanium self-reported and patched the issue.
Improper access controls in Tanium Comply allow authenticated low-privileged users to perform unauthorized actions affecting integrity and availability via CWE-639 (Authorization Bypass Through User-Controlled Key). Affected versions span three active release branches: 2.32, 2.35, and 2.37, each with specific fixed builds. Tanium has released patched versions and no active exploitation or public exploit code has been identified at time of analysis.
Improper access controls in Tanium Comply allow an authenticated low-privileged user to perform unauthorized write actions against compliance data or configuration, resulting in limited integrity impact. Affected across three active release branches - 2.32, 2.35, and 2.37 - with specific patch thresholds published by Tanium. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing this in the category of moderate enterprise risk requiring patching within standard change-management windows.
Tanium Comply contains an improper access control vulnerability (CWE-639, Authorization Bypass Through User-Controlled Key) that allows authenticated low-privileged users to perform unauthorized integrity-affecting or availability-impacting actions against compliance data by manipulating user-controlled object references. Affected branches span three minor release lines (2.32, 2.35, 2.37) with fixed versions available. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the medium CVSS score of 5.4. The vendor (Tanium) self-reported and released patches across all affected branches.
Improper access controls in Tanium Comply allow authenticated low-privileged users to bypass object-level authorization and access or manipulate compliance data belonging to other users or tenants. Affecting three active release branches (2.32, 2.35, 2.37), the flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of vulnerability commonly known as Insecure Direct Object Reference (IDOR). Tanium self-disclosed and patched the issue via advisory TAN-2026-038; no public exploit or active exploitation has been identified at time of analysis.
Improper access controls in Tanium Comply allow an authenticated low-privileged user to perform unauthorized write operations they should not be permitted to execute. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application fails to enforce object-level authorization checks, allowing a user to manipulate resource identifiers to access or modify other users' or roles' data. No public exploit has been identified at time of analysis, and EPSS data is not available in the provided intelligence.
Improper access controls in Tanium Comply (CWE-862 Missing Authorization) allow authenticated low-privilege users to perform actions or access data beyond their authorized scope. Three active release branches are affected: 2.32, 2.35, and 2.37. No public exploit code and no CISA KEV listing have been identified at time of analysis; Tanium has released patched builds across all affected branches.
Tanium addressed an incorrect default permissions vulnerability in Comply. [CVSS 6.5 MEDIUM]
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to perform unauthorized actions, producing high integrity and availability impact across the platform. Tanium disclosed this vulnerability via advisory TAN-2026-041; the CVSS 8.1 score reflects network-reachable exploitation requiring only a valid low-privilege account with no user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Server-side template injection (SSTI) in Tanium Comply enables remote code execution by a highly privileged authenticated user, yielding full confidentiality, integrity, and availability impact on the Comply server. The vulnerability (CWE-1336) results from insufficient neutralization of template directives in user-controlled input, allowing the underlying template engine to evaluate and execute injected payloads server-side. Tanium addressed this in advisory TAN-2026-040; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's intended directory scope, resulting in high confidentiality impact and scope change to the broader host system. The CVSS vector (S:C, C:H) indicates the traversal can reach resources beyond the Comply component itself, potentially exposing sensitive configuration, credentials, or endpoint compliance data accessible to the Tanium platform. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user interaction and high attack complexity - to execute arbitrary SQL against the backend database, with a scope change that extends impact beyond the Comply application itself to C:H/I:H/A:H. Tanium addressed this in advisory TAN-2026-042. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Improper access controls (CWE-862 Missing Authorization) in Tanium Comply expose compliance and vulnerability assessment data to authenticated users who lack sufficient privileges to access it. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) scores this at 7.1, with high confidentiality impact and limited integrity risk, exploitable over the network by any low-privileged Tanium account holder with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write against the underlying host. The CVSS vector (AV:N/AC:L/PR:L/S:C/I:H) confirms the vulnerability is network-reachable without administrative credentials and breaks containment boundaries beyond the Comply module itself. Tanium addressed the issue under advisory TAN-2026-043; no public exploit code or CISA KEV listing is currently identified.
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations with high integrity and availability impact over the network. Exploiting this CWE-863 (Incorrect Authorization) flaw, an attacker with minimal authenticated access can bypass authorization enforcement within the Comply module, potentially altering compliance posture data or disrupting compliance workflows. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed.
Improper access controls in Tanium Comply (CWE-862, Missing Authorization) allow authenticated low-privileged users to perform unauthorized actions affecting the integrity and availability of the compliance module. Three active release branches are affected - 2.32.x, 2.35.x, and 2.37.x - with vendor-issued patches available for each. No active exploitation has been identified and no public proof-of-concept exists at time of analysis.
Improper access controls in Tanium Comply allow an authenticated low-privileged network user to perform write operations beyond their authorization level, resulting in high integrity impact. Three active release branches are affected: 2.32, 2.35, and 2.37, each with specific fixed builds released by Tanium under advisory TAN-2026-029. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the network-accessible, low-complexity vector lowers the bar for exploitation by any authenticated user.
Information disclosure in Tanium Comply allows authenticated low-privilege network users to access data beyond their authorization level. Versions in the 2.37 branch prior to 2.37.308 are confirmed affected per the EUVD advisory tied to vendor bulletin TAN-2026-032. No public exploit code or active exploitation has been identified; Tanium self-reported and patched the issue.
Improper access controls in Tanium Comply allow authenticated low-privileged users to perform unauthorized actions affecting integrity and availability via CWE-639 (Authorization Bypass Through User-Controlled Key). Affected versions span three active release branches: 2.32, 2.35, and 2.37, each with specific fixed builds. Tanium has released patched versions and no active exploitation or public exploit code has been identified at time of analysis.
Improper access controls in Tanium Comply allow an authenticated low-privileged user to perform unauthorized write actions against compliance data or configuration, resulting in limited integrity impact. Affected across three active release branches - 2.32, 2.35, and 2.37 - with specific patch thresholds published by Tanium. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing this in the category of moderate enterprise risk requiring patching within standard change-management windows.
Tanium Comply contains an improper access control vulnerability (CWE-639, Authorization Bypass Through User-Controlled Key) that allows authenticated low-privileged users to perform unauthorized integrity-affecting or availability-impacting actions against compliance data by manipulating user-controlled object references. Affected branches span three minor release lines (2.32, 2.35, 2.37) with fixed versions available. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the medium CVSS score of 5.4. The vendor (Tanium) self-reported and released patches across all affected branches.
Improper access controls in Tanium Comply allow authenticated low-privileged users to bypass object-level authorization and access or manipulate compliance data belonging to other users or tenants. Affecting three active release branches (2.32, 2.35, 2.37), the flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of vulnerability commonly known as Insecure Direct Object Reference (IDOR). Tanium self-disclosed and patched the issue via advisory TAN-2026-038; no public exploit or active exploitation has been identified at time of analysis.
Improper access controls in Tanium Comply allow an authenticated low-privileged user to perform unauthorized write operations they should not be permitted to execute. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application fails to enforce object-level authorization checks, allowing a user to manipulate resource identifiers to access or modify other users' or roles' data. No public exploit has been identified at time of analysis, and EPSS data is not available in the provided intelligence.
Improper access controls in Tanium Comply (CWE-862 Missing Authorization) allow authenticated low-privilege users to perform actions or access data beyond their authorized scope. Three active release branches are affected: 2.32, 2.35, and 2.37. No public exploit code and no CISA KEV listing have been identified at time of analysis; Tanium has released patched builds across all affected branches.
Tanium addressed an incorrect default permissions vulnerability in Comply. [CVSS 6.5 MEDIUM]