CVE-2026-87034: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Tanium Comply

CVE-2026-87034 is a SQL injection vulnerability in Tanium Comply that arises from improper neutralization of special elements in SQL commands. This flaw affects versions 2.32, 2.35, and 2.37 of the product. The vulnerability has a CVSS 3.1 base score of 8.3, with network attack vector, high attack complexity, no privileges required, and requires user interaction. It impacts confidentiality, integrity, and availability with a scope change. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands, potentially leading to unauthorized disclosure, modification, or deletion of data, and disruption of service. The CVSS vector indicates high impact on confidentiality, integrity, and availability, with a scope change, meaning the vulnerability could affect components beyond the initially vulnerable one.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the affected versions 2.32, 2.35, and 2.37 in environments where exposure to untrusted users is possible. Monitor Tanium's official channels for updates and apply patches promptly once released.