Tanium Connect CVE-2026-12139

Exploitation requires local access to the host running Tanium Connect and high-privilege (administrative or operator-level) credentials on that host - consistent with the CVSS vector AV:L/PR:H. The vulnerability is rooted in how the Connect process handles sensitive information during invocation (CWE-214), meaning exposure occurs on the local system rather than over a network. No special non-default configuration is described as required; the condition is access to the host with sufficient privilege to inspect process state. Limiting factors: network-only attackers cannot exploit this; unauthenticated users cannot exploit this; and low-privilege local accounts (absent privilege escalation) are likely insufficient. The realistic attacker is a Tanium platform administrator, a compromised privileged account, or an attacker who has already achieved local code execution at elevated privilege.

Real-world risk is bounded by the PR:H and AV:L constraints in the CVSS vector - an attacker must already possess high-privilege local access to the affected host before exploiting this vulnerability. The CVSS score of 4.4 (Medium) appropriately reflects this reduced attack surface despite the C:H confidentiality impact. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, nor is any public exploit code known. The practical threat model is a malicious insider, a compromised admin account, or a post-exploitation pivot scenario where an attacker already holds elevated local access and seeks to harvest credentials from process state. The high confidentiality impact is significant in that context - Connect integrations may hold credentials for downstream systems - but the prerequisite of PR:H substantially limits the population of realistic attackers. This is not a priority for perimeter-focused teams but is relevant to insider-threat and privileged-access management programs.

A malicious insider or attacker who has compromised an account with local administrative privileges on the Tanium Module Server runs a process listing tool (e.g., ps aux or Process Monitor on Windows) and observes sensitive data - such as database credentials or API tokens - passed as arguments or visible in the environment of the Tanium Connect process. No public exploit code exists for this scenario; exploitation requires pre-existing high-privilege local access.