CVE-2026-87033

Undergoing Analysis Undergoing Analysis - In Progress

Improper Access Controls in Tanium Comply

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: Tanium

Description

Tanium addressed an improper access controls vulnerability in Comply.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87033

EUVD

EUVD-2026-74554

Affected Vendors & Products

Vendor	Product	Version / Range
tanium	comply	to v2.32.252 (exc)
tanium	comply	to v2.35.306 (exc)
tanium	comply	to v2.37.308 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper access control issue in Tanium Comply. It allows an authenticated user with specific permissions to modify network reports that belong to any content set, potentially leading to unauthorized changes in compliance data.

Detection Guidance

Check the version of Tanium Comply installed on your system. Compare it against the affected versions listed: 2025H1 Release prior to Update 24 (v2.32 to v2.32.252), 2025H2 Release prior to Update 14 (v2.35 to v2.35.306), or 2026H1 Release prior to Update 7 (v2.37 to v2.37.308).

Review user permissions in Tanium Comply, specifically for the Comply Report Write permission, to ensure no unauthorized modifications can occur.

Impact Analysis

If exploited, this vulnerability could allow unauthorized modifications to compliance reports, potentially leading to incorrect compliance statuses, data integrity issues, or misleading audit results for affected systems.

Compliance Impact

This vulnerability could undermine compliance with standards like GDPR or HIPAA by allowing unauthorized changes to compliance reports, which may result in inaccurate records and potential violations of data protection or security requirements.

Mitigation Strategies

Apply the latest updates to Tanium Comply immediately: Update 24 (v2.32.252) or later for 2025H1, Update 14 (v2.35.306) or later for 2025H2, or Update 7 (v2.37.308) or later for 2026H1.

Restrict the Comply Report Write permission to only necessary users to reduce the risk of unauthorized modifications.

Hi! I’m here to help you understand CVE-2026-87033. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70