PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-87046 Tanium CVE debrief

Tanium addressed an improper access controls vulnerability in Comply. The CVE record was published on 2026-09-09T03:17:26.380Z and has not been modified since then. This vulnerability affects Tanium Comply deployments, particularly versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308. Defenders should assess exposure and prioritize verification and remediation based on the vendor advisory and updates. The vulnerability has a CVSS score of 4.3 and a severity of MEDIUM.

Vendor
Tanium
Product
Comply
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-09
Original CVE updated
2026-09-16
Advisory published
2026-09-09
Advisory updated
2026-09-16

Who should care

Defenders responsible for Tanium Comply deployments should assess exposure and prioritize verification and remediation. This includes reviewing and applying vendor advisory and updates, monitoring for potential unauthorized access, and verifying Tanium Comply version and checking for exposure.

Why it matters

Defenders should prioritize verifying exposure in Tanium Comply deployments, especially for versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308, and apply vendor advisory and updates.

  • Verify and restrict access to sensitive areas
  • Monitor for potential unauthorized access
  • Apply vendor advisory and updates

Technical summary

The vulnerability is an improper access controls issue in Tanium Comply, with a CVSS score of 4.3 and a severity of MEDIUM. This issue affects Tanium Comply deployments, particularly versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308. Defenders should prioritize verifying exposure and apply vendor advisory and updates to mitigate potential unauthorized access.

Defensive priority

Defenders should prioritize verifying exposure in Tanium Comply deployments, especially for versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308.

Recommended defensive actions

  • Verify Tanium Comply version and check for exposure
  • Review and apply vendor advisory
  • Monitor for potential unauthorized access

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. Evidence is limited to publicly available information from the CVE Program and NVD. Defenders should verify exposure in Tanium Comply deployments, especially for versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308, and apply vendor advisory and updates.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-87046 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-87046

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-87046 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87046

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://security.tanium.com/TAN-2026-026

    3938794e-25f5-4123-a1ba-5cbd7f104512 - Vendor Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.