Skip to content

TAN-2026-042

Tanium addressed a SQL injection vulnerability in Comply.

Severity: High

Base Score: 8.3

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Impact

This vulnerability could allow an attacker with privileged access to a system running the Tanium Client to tamper with the SQL query executed by the Comply service.

Products Affected

2025H1 Release:

  • Comply prior to Update 24 (v2.32 to v2.32.252)

2025H2 Release:

  • Comply prior to Update 14 (v2.35 to v2.35.306)

2026H1 Release:

  • Comply prior to Update 7 (v2.37 to v2.37.308)

Available Updates

2025H1 Release:

  • Update 24 (Comply v2.32.252) and later

2025H2 Release:

  • Update 14 (Comply v2.35.306) and later

2026H1 Release:

  • Update 7 (Comply v2.37.308) and later

Workaround and Mitigations

None.

Acknowledgements

None.