Tanium Connect CVE-2026-9207

Exploitation requires an authenticated, low-privileged account on Tanium Connect (CVSS PR:L) with the ability to influence a Connect feature that constructs an OS command - i.e., the attacker must be able to submit input into a Connect connection/destination/job configuration that reaches the vulnerable command-execution path. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L). The primary limiting factors are: (1) the requirement for valid Connect credentials/role rather than fully anonymous access, and (2) running an affected build (Connect <5.26.191, <5.29.237, or <5.37.140). The exact feature/parameter that accepts the injectable input is not specified in the provided description and should be confirmed against vendor advisory TAN-2026-014.

Signals are mixed but lean toward 'patch promptly, not emergency.' The CVSS vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) describes a remotely reachable, low-complexity, no-user-interaction flaw that grants full host compromise - but PR:L confirms the attacker must already hold a valid low-privileged Connect/Tanium account, which meaningfully gates exploitation to insiders or attackers who have already obtained credentials. Real-world urgency is tempered by the low EPSS score (0.07%, 22nd percentile) and the absence of CISA KEV listing or any public exploit code, suggesting no observed widespread exploitation. The high impact and low attack complexity justify prioritized patching, especially given Tanium's privileged position in an environment, but this is not currently an actively-exploited zero-day. Note the data limitation: KEV and POC status are simply absent from the input rather than explicitly negated, so 'no public exploit identified' reflects available data, not a guarantee.

An attacker who has obtained a low-privileged Tanium Connect account (for example, a malicious insider or a credential-phished operator) crafts a malicious value within a Connect connection/destination configuration that is passed unsanitized into an OS command. When the connection runs, the injected command executes on the Tanium platform host, giving the attacker code execution with the service's privileges. Given AV:N/AC:L, this requires only network access to the authenticated interface and no user interaction, though no public proof-of-concept has been identified at time of analysis.