CVE-2026-87036 Tanium CVE debrief

Who should care

Defenders responsible for Tanium Comply environments should assess exposure and prioritize patching or compensating controls to prevent unauthorized access. This includes reviewing and adjusting access controls, monitoring for suspicious activity, and applying patches or updates to affected Tanium Comply versions. The vulnerability's HIGH severity and CVSS score of 8.1 emphasize the importance of prompt action to in

Why it matters

CVE-2026-87036 is a HIGH severity vulnerability in Tanium Comply that requires verification of exposure and prompt patching or compensating controls to prevent unauthorized access.

• Verify and adjust access controls to prevent unauthorized access
• Apply patches or updates to affected Tanium Comply versions
• Monitor for suspicious activity in Tanium Comply environments

Technical summary

The vulnerability is an improper access controls issue in Tanium Comply, which has been addressed by Tanium. The affected versions are 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308. This issue allows for unauthorized access, and defenders should prioritize verifying exposure and applying patches or compensating controls to prevent exploitation. The CVSS score of 8.1 indicates a HIGH severity vulnerability.

Defensive priority

Defenders should prioritize verifying exposure in Tanium Comply environments, especially for versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308, and applying patches or compensating controls.

Recommended defensive actions

• Verify Tanium Comply version and apply patches or updates if necessary
• Review and adjust access controls for Tanium Comply
• Monitor Tanium Comply for suspicious activity

Evidence notes

The CVE record and NVD detail page provide official information about the vulnerability. A vendor advisory is available from Tanium. The vulnerability has been addressed by Tanium, and the affected versions are 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308. Defenders should verify exposure and prioritize patching or compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.