CVE-2026-87021
Undergoing Analysis Undergoing Analysis - In Progress

Unauthorized Code Execution in Tanium Comply

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: Tanium

Description
Tanium addressed an unauthorized code execution vulnerability in Comply.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-09
Last Modified
2026-09-09
Generated
2026-09-29
AI Q&A
2026-09-09
EPSS Evaluated
2026-09-27
NVD
CVE-2026-87021
EUVD
EUVD-2026-74563

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
tanium comply to 2.32.252 (exc)
tanium comply to 2.35.306 (exc)
tanium comply to 2.37.308 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthorized code execution vulnerability in Tanium Comply. An authenticated user with specific permissions could exploit it to run unauthorized code within the Comply service context. The vulnerability has a high severity score of 7.2.

Detection Guidance

Detection requires checking the installed Comply version against the affected releases. Use Tanium's built-in inventory tools or run commands like 'tanium package list' or 'comply --version' to verify the version. Compare against v2.32.252 (2025H1), v2.35.306 (2025H2), or v2.37.308 (2026H1). If versions are older, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to data breaches, system compromise, or unauthorized access to sensitive information within the Comply service.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance standards like GDPR or HIPAA. However, unauthorized code execution in Tanium Comply could potentially lead to unauthorized access or modification of sensitive data, which may violate compliance requirements depending on the data processed.

Mitigation Strategies

Apply the latest updates for your Comply version: Update 24 for 2025H1, Update 14 for 2025H2, or Update 7 for 2026H1. Ensure users with Comply Report Content Write and Comply Report Write permissions are reviewed to limit unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87021. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart