Security Resilience

CVE-2026-87075

Access Control in Tanium Comply 2.32.0 – 2.32.252

Access Control
Published
09 September 2026
Modified
16 September 2026
Patch / advisory
View advisory
CVSS Score v3.1 8.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0038 32th percentile
Risk Priority 59 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-87075 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Tanium Comply. Its CVSS base score is 8.1 (High).

Operationally, ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

Tanium addressed an improper access controls vulnerability in Comply.

CWE(s)
CWE-863

Related Threats

CVEs Like This One

CVE-2026-87030Same product: Tanium Comply
CVE-2026-87023Same product: Tanium Comply
CVE-2025-15340Same product: Tanium Comply
CVE-2026-87036Same product: Tanium Comply
CVE-2026-87021Same product: Tanium Comply
CVE-2026-87034Same product: Tanium Comply
CVE-2026-87072Same product: Tanium Comply
CVE-2025-15342Same vendor: Tanium
CVE-2025-15322Same vendor: Tanium
CVE-2025-15288Same vendor: Tanium

Affected Assets

tanium
comply
2.32.0 — 2.32.252 · 2.35.0 — 2.35.306 · 2.37.0 — 2.37.308

Mitigating Controls

Mitigating Controls (NIST 800-53 r5)

Our mappings, made for this CVE.

AC-3 Access Enforcement good match

AC-3 directly requires correct enforcement of authorization decisions on every access request, structurally preventing incorrect checks.

AC-24 Access Control Decisions good match

AC-24 ensures access-control decisions are made and applied consistently, reducing the chance of an incorrect authorization result.

AC-25 Reference Monitor good match

A reference monitor that is always invoked and tamper-proof forces every authorization decision through a verified, correct path.

AC-6 Least Privilege partial match

Least-privilege assignments shrink the set of authorizations that must be checked correctly, limiting exposure to flawed checks.

Mitigating Controls (ISO/IEC 27001:2022 Annex A)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.

A.8.3 Information access restriction full match
blocks

A.8.3's access restriction mechanisms, including granular per-user and per-identity controls, directly enforce correct authorization checks, preventing exploitation of incorrect authorization flaws.

A.5.15 Access control partial match
blocks

Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-863, a class-level weakness, and none of its children carries one either.

References