CVE-2026-87023: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Tanium Comply

CVE-2026-87023 is a path traversal vulnerability in Tanium Comply that allows an attacker with low privileges to bypass pathname restrictions to access files outside intended directories. The vulnerability has a CVSS 3.1 score of 8.5, indicating high severity with network attack vector, low attack complexity, no user interaction required, and a scope change. The impact is high confidentiality loss and low availability impact. Affected versions explicitly include 2.32, 2.35, and 2.37. No vendor advisory or patch information is currently provided.

An attacker with low privileges can exploit this vulnerability remotely to access sensitive files outside the intended restricted directories, resulting in high confidentiality impact. Integrity is not impacted, and availability impact is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor Tanium's official channels for updates and apply patches once available.