What is the CVSS score of CVE-2026-12139?

CVE-2026-12139 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-12139?

Yes, a patch is available for CVE-2026-12139. Update the affected software to the latest version immediately.

Tanium Connect CVE-2026-12139

EUVD-2026-46406 MEDIUM

Invocation of Process Using Visible Sensitive Information (CWE-214)

2026-07-21 Tanium

GHSA-w2w5-6rpf-f2w8

Information Disclosure Connect

5.5

CVSS 3.1 · NVD

Severity by source

Vendor (Tanium) PRIMARY

MEDIUM

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.4 MEDIUM

Local-only vector confirmed by CWE-214 process-invocation class; PR:H because inspection of process state requires existing elevated administrative access.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Tanium).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 18, 2026 - 19:07 NVD

4.4 (MEDIUM) 5.5 (MEDIUM)

Patch available

Jul 21, 2026 - 23:36 EUVD

Analysis Generated

Jul 21, 2026 - 21:13 vuln.today

DescriptionNVD

Tanium addressed an information disclosure vulnerability in Connect.

AnalysisAI

Information disclosure in Tanium Connect exposes sensitive data to local administrators via process invocation metadata. The vulnerability (CWE-214) allows a locally authenticated, highly privileged user to observe sensitive information - such as credentials or tokens - that the Connect component surfaces through visible process arguments or environment state. No active exploitation has been identified and no public proof-of-concept exists, but the high confidentiality impact (C:H) means exposed data could facilitate lateral movement or privilege escalation within the Tanium management plane.

Technical ContextAI

CWE-214 (Invocation of Process Using Visible Sensitive Information) describes a class of vulnerabilities where a process exposes sensitive data - credentials, API keys, tokens - through mechanism such as command-line arguments, environment variables, or inter-process communication that are visible to other privileged users on the same host. Tanium Connect is a data integration component of the Tanium endpoint management platform, used to relay telemetry and connect Tanium with external systems such as SIEMs or databases. The affected CPE (cpe:2.3:a:tanium:connect:*:*:*:*:*:*:*:*) covers all versions of the Connect application without a constrained version range in the available data. The local attack vector (AV:L) and high privilege requirement (PR:H) confirm that exploitation is confined to users who already hold administrative or operator-level access on the host running Connect.

RemediationAI

Consult and apply the vendor-issued fix documented in Tanium advisory TAN-2026-018 at https://security.tanium.com/TAN-2026-018 - an exact patched version is not independently confirmed from the available data, so reference the advisory directly for the target upgrade version. As a compensating control pending patching, restrict local administrative access to the Tanium Module Server hosting Connect to the minimum required operators, using role-based access controls within Tanium and OS-level account restrictions. Audit which accounts hold elevated local access to that host. Consider reviewing Connect integration credentials stored in the platform and rotating any secrets that may have been exposed via process inspection. Note that restricting process visibility (e.g., hidepid mount options on Linux) can reduce exposure without requiring an immediate patch, though this may interfere with monitoring tooling.