CVE-2026-87021: Improper Neutralization of Special Elements Used in a Template Engine in Tanium Comply

This vulnerability in Tanium Comply arises from improper neutralization of special elements in the product's template engine, leading to unauthorized code execution. The flaw affects specific versions 2.32, 2.35, and 2.37. The CVSS 3.1 base score is 7.2, with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No vendor remediation level or patch information is provided in the available data.

Successful exploitation could allow an attacker with high privileges to execute unauthorized code remotely, potentially compromising confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is indicated, users of affected versions (=2.32, =2.35, =2.37) should monitor Tanium's official channels for updates and apply patches promptly once available.