PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-87048 Tanium CVE debrief

Tanium addressed an improper access controls vulnerability in Comply. The CVE record was published on 2026-09-09T03:17:26.610Z and has not been modified since then. This vulnerability affects Tanium Comply deployments, particularly versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308. Defenders should assess exposure and prioritize verification and remediation efforts. The vulnerability has a CVSS score of 5.4 and a severity of MEDIUM. The CVE record and NVD entry provide details on the vulnerability.

Vendor
Tanium
Product
Comply
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-09
Original CVE updated
2026-09-16
Advisory published
2026-09-09
Advisory updated
2026-09-16

Who should care

Defenders responsible for Tanium Comply deployments should assess exposure and prioritize verification and remediation efforts, especially for versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308. They should review and apply vendor advisory for remediation and monitor for potential unauthorized access. Security teams and vulnerability management teams should also prioritize verifying exposure and

Why it matters

Defenders should prioritize verifying exposure in Tanium Comply deployments, especially for versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308, and apply vendor advisory for remediation.

  • Verify and restrict access to sensitive areas
  • Monitor for potential unauthorized access
  • Apply vendor advisory for remediation

Technical summary

The vulnerability is an improper access controls issue in Tanium Comply, with a CVSS score of 5.4 and severity of MEDIUM. Affected versions include 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308. The issue allows for potential unauthorized access. Defenders should prioritize verifying exposure in Tanium Comply deployments, especially for the mentioned versions, and apply vendor advisory for remediation.

Defensive priority

Defenders should prioritize verifying exposure in Tanium Comply deployments, especially for versions 2.32.0 to 2.32.252, 2.35.0 to 2.35.306, and 2.37.0 to 2.37.308.

Recommended defensive actions

  • Verify Tanium Comply version and check for exposure
  • Review and apply vendor advisory
  • Monitor for potential unauthorized access

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.4 and severity of MEDIUM. Vendor advisory is available.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-87048 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-87048

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-87048 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87048

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://security.tanium.com/TAN-2026-027

    3938794e-25f5-4123-a1ba-5cbd7f104512 - Vendor Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.