CVE-2026-87035

Undergoing Analysis Undergoing Analysis - In Progress

Information Disclosure in Tanium Comply

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: Tanium

Description

Tanium addressed an information disclosure vulnerability in Comply.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87035

EUVD

EUVD-2026-74555

Affected Vendors & Products

Vendor	Product	Version / Range
tanium	comply	to 2.37.308 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is an information disclosure vulnerability in Tanium Comply. It allows an authenticated user with specific permissions to access restricted data they should not be able to see. The vulnerability exists in versions of Comply prior to Update 7 (version 2.37.308).

Detection Guidance

To detect this vulnerability, check if your Tanium Comply instance is running version 2.37.308 or later. Use the Tanium console or CLI to verify the installed version. If the version is prior to 2.37.308, the system is vulnerable.

Impact Analysis

If you use Tanium Comply, an attacker with access to an authenticated user account with report write permissions could read sensitive data they are not authorized to see. This could lead to unauthorized access to confidential information.

Compliance Impact

This vulnerability could potentially violate compliance requirements that mandate strict access controls and protection of sensitive data, such as GDPR or HIPAA. Unauthorized data access may result in non-compliance penalties or legal consequences.

Mitigation Strategies

Update Comply to version 2.37.308 or later. No additional workarounds are required as the issue is resolved in Update 7.

Hi! I’m here to help you understand CVE-2026-87035. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70