Tanium Deploy CVE-2026-120775

Exploitation requires the attacker to already hold high privileges on the Tanium Deploy service (CVSS PR:H) - this is the primary limiting factor and means default, unauthenticated external exploitation is not supported by the data. The flaw is reachable over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N) once that privileged access is held. The specific feature, request, or input that triggers the heap-based buffer overflow is not described in the available sources, and no affected/fixed version boundary is stated, so defenders should treat any privileged-accessible Deploy instance as potentially affected until the vendor advisory confirms versions.

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, scope unchanged, C:H/I:H/A:H, base 7.2 High) shows a network-reachable flaw with low attack complexity and no user interaction, but it requires high privileges (PR:H) - so the attacker must already hold a privileged/authenticated position on Tanium Deploy before this heap-based buffer overflow (CWE-122) is useful. EPSS is not provided, so no quantitative exploitation probability is available. The vulnerability is NOT in CISA KEV and no public exploit or PoC reference is supplied - the only reference is the vendor advisory itself. The vuln.today decision label is 'this_week', which indicates a near-term patching priority but explicitly not 'act_now' or 'emergency'. The signals are internally consistent: a serious memory-corruption bug with full CIA impact, gated behind existing privileges, with no evidence of exploitation or weaponization. The main data gap is mechanism - the description ('Tanium addressed a heap-based buffer overflow vulnerability in Deploy') states neither the trigger nor the affected versions, so the real-world attack surface cannot be fully scoped from the available data.

An attacker who already possesses high-privilege/authenticated access to a Tanium Deploy instance sends a crafted network request that triggers a heap-based buffer overflow, corrupting memory to achieve code execution or full compromise of the service. No public exploit code has been identified at time of analysis, and the trigger is not described in the available sources. Because PR:H is required, this is most plausible as a privilege-leveraging or insider/lateral-movement step rather than an initial external breach.