Quick answers
- Is CVE-2026-87030 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-87030 being exploited in the wild.
- How severe is CVE-2026-87030?
- High severity, with a CVSS score of 8.5, published 9 September 2026.
- Which products and versions are affected?
- Tanium Comply 2.25-2.32.251, 2.35-2.35.305, 2.37-2.37.307.
- Is there a fix for CVE-2026-87030?
- A patch was published on 2026-09-09: Patches available for all affected releases Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-87030 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-87030?
- Check whether you run Tanium Comply at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a path traversal vulnerability (CWE-22) in Tanium Comply that allows authenticated users to access and manipulate files outside intended directories. The vulnerability requires the attacker to have Comply Deployment Write permission and authenticate to the system. By exploiting this vulnerability, an attacker can delete arbitrary files on the Tanium Module Server, affecting confidentiality through potential information disclosure and integrity through file deletion. Patches are available: version 2.32.252 or later (2025H1), version 2.35.306 or later (2025H2), and version 2.37.308 or later (2026H1).
Affected products
- Tanium Comply 2.25-2.32.251, 2.35-2.35.305, 2.37-2.37.307
Timeline
- 2026-09-09: disclosed
- 2026-09-09: patched: Patches available for all affected releases