PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-87025 Tanium CVE debrief

Tanium addressed an improper access controls vulnerability in Comply. The CVE record was published on 2026-09-09T03:17:25.437Z and has not been modified since then. This vulnerability affects Tanium Comply deployments, particularly versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308. Defenders should assess their exposure and verify access controls to prevent potential unauthorized access. The CVSS score is 5.4, and the severity is medium. The vulnerability is an improper access controls issue, and Tanium has addressed it.

Vendor
Tanium
Product
Comply
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-09
Original CVE updated
2026-09-16
Advisory published
2026-09-09
Advisory updated
2026-09-16

Who should care

Defenders responsible for Tanium Comply deployments should assess their exposure and verify access controls, especially for versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308. They should prioritize verifying exposure and updating access controls to prevent potential unauthorized access.

Why it matters

Defenders should prioritize verifying exposure in Tanium Comply deployments, especially for versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308, to prevent potential unauthorized access.

  • Verify access controls for Comply to prevent potential unauthorized access
  • Assess deployment context for potential access control issues
  • Review and update access controls for Comply

Technical summary

The vulnerability, CVE-2026-87025, is an improper access controls issue in Tanium Comply. The CVSS score is 5.4, and the severity is medium. Affected versions include 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308. The issue has been addressed by Tanium. Defenders should assess their exposure and verify access controls to prevent potential unauthorized access.

Defensive priority

Defenders should prioritize verifying exposure in Tanium Comply deployments, especially for versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308.

Recommended defensive actions

  • Verify Tanium Comply version and check for exposure
  • Assess deployment context for potential access control issues
  • Review and update access controls for Comply

Evidence notes

The NVD entry provides a CVSS score of 5.4 and a medium severity rating. Tanium has addressed an improper access controls vulnerability in Comply. The vulnerability affects versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308 of Tanium Comply. Defenders should verify exposure and access controls, especially for these versions, to prevent potential unauthorized access.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-87025 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-87025

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-87025 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87025

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://security.tanium.com/TAN-2026-045

    3938794e-25f5-4123-a1ba-5cbd7f104512 - Vendor Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.