{"id":"CVE-2026-116647","kind":"vulnerability","aliases":["CVE-2026-116647"],"related":[],"title":"Tanium Comply: improper output sanitization flaw, details unknown","description":"Tanium addressed an improper output sanitization vulnerability in Comply.","summary":"Tanium Comply does not neutralize formula elements in CSV files it exports (CWE-1236). An attacker with access to a system running the Tanium Client can inject arbitrary data, including spreadsheet formulas, into Comply CSV exports. CVSS 7.1 (network, no privileges, user interaction required). No exploitation or public PoC found.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Tanium Comply","fixed":["2.32.263","2.35.323","2.37.326"],"affected":">= 2.32, < 2.32.263; >= 2.35, < 2.35.323; >= 2.37, < 2.37.326","ecosystem":"vendor"}],"ecosystems":[],"tags":["comply","csv-injection","formula-injection","tanium","vendor"],"not_affected_if":[],"how_to_check":"In the Tanium Console, check the installed Comply version. You are affected if it is below 2.32.263 (2025H1), 2.35.323 (2025H2) or 2.37.326 (2026H1).","fix":"Update Comply to 2.32.263 (2025H1 Update 26), 2.35.323 (2025H2 Update 16) or 2.37.326 (2026H1 Update 9), or later. Vendor lists no workaround.","status":"open","published_at":"2026-10-27T18:17:34+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","triaged_at":"2026-10-27T18:34:39+00:00","updated_at":"2026-10-27T18:36:57+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-27T18:34:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Tanium Comply: improper output sanitization flaw, details unknown","impact":"medium","summary":"Tanium has fixed an improper output sanitization flaw in its Comply product. The sources do not say what an attacker can do with it.","category":"vendor","nicknames":[],"who_cares":["tanium","comply"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the Tanium security advisory and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-116647) for affected Comply versions, the fixed version, and the attack vector.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000482,"input_tokens":3228,"output_tokens":318,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Tanium security advisory and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-116647) for affected Comply versions, the fixed version, and the attack vector.","search":"'-116647':11A,14A '-1236':39B '-2026':10A,13A '7.1':63B 'access':43B 'address':77C 'arbitrari':53B 'attack':41B 'client':50B 'compli':2A,17B,27B,59B,84C 'comply':16A 'csv':19B,34B,60B 'csv-inject':18B 'cve':9A,12A 'cvss':62B 'cwe':38B 'data':54B 'detail':7A 'element':32B 'exploit':71B 'export':37B,61B 'file':35B 'flaw':6A 'formula':22B,31B,57B 'formula-inject':21B 'found':75B 'improp':3A,79C 'includ':55B 'inject':20B,23B,52B 'interact':68B 'network':64B 'neutral':30B 'output':4A,80C 'poc':74B 'privileg':66B 'public':73B 'requir':69B 'run':47B 'sanit':5A,81C 'spreadsheet':56B 'system':46B 'tanium':1A,15A,24B,26B,49B,76C 'unknown':8A 'user':67B 'vendor':25B 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Tanium Comply (on-prem or cloud) and export compliance or vulnerability reports to CSV. An attacker who controls an endpoint running the Tanium Client can plant data that becomes live formulas when someone opens the export in a spreadsheet. If nobody exports Comply data to CSV, exposure is low.","tier":"B","verified":{"fix":{"at":"2026-10-27T18:36:57Z","by":"analyst","run_id":914},"products":{"at":"2026-10-27T18:36:57Z","by":"analyst","run_id":914},"mitigations":{"at":"2026-10-27T18:36:57Z","by":"analyst","run_id":914},"workarounds":{"at":"2026-10-27T18:36:57Z","by":"analyst","run_id":914},"who_affected":{"at":"2026-10-27T18:36:57Z","by":"analyst","run_id":914}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"3938794e-25f5-4123-a1ba-5cbd7f104512","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116647","severity":null,"published_at":"2026-10-27T18:17:34+00:00","modified_at":"2026-10-27T18:17:34+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","fetched_at":"2026-10-27T18:32:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116647:914","url":null,"severity":null,"published_at":"2026-10-27T18:36:57+00:00","modified_at":"2026-10-27T18:36:57+00:00","first_seen_at":"2026-10-27T18:36:57+00:00","fetched_at":"2026-10-27T18:36:57+00:00","note":"Read Tanium TAN-2026-069 (vendor) and CVE record: CSV/formula injection in Comply exports, CVSS 7.1, fixed in Updates 26/16/9; no workaround; no exploitation or PoC found."}],"documents":[{"id":7383,"url":"https://security.tanium.com/TAN-2026-069","title":"TAN-2026-069 Tanium Comply improper output sanitization","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":7384,"url":"https://www.cve.org/CVERecord?id=CVE-2026-116647","title":"CVE Record CVE-2026-116647","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}