# CVE-2026-12391 — Canonical ubuntu-pro-client (ubuntu-advantage-tools)

> As of 2026-07-16, CVE-2026-12391 is a MEDIUM-severity vulnerability in Canonical ubuntu-pro-client (ubuntu-advantage-tools), CVSS v3.1 5, EPSS 0.2% (9.7th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2026-12391, most recently “Critical Ubuntu Pro Client Vulnerability Enables Root Code Execution via Contract Server Spoofing (CVE-2026-11386)”.

**Last updated:** 2026-07-16

## What is CVE-2026-12391?

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.

The record classifies CVE-2026-12391 under weakness class [CWE-59](https://intel.threadlinqs.com/cwe/CWE-59). Its CVSS v3 base vector states that the flaw requires local access to the host, needs low-privilege credentials, needs a user to take an action first, and has high impact on confidentiality. 7 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 101 days ago.

## Severity and exploitation probability

- **CVSS v3.1 base score:** 5 — MEDIUM (`CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N`)
- **EPSS (FIRST):** 0.2% probability of exploitation in the next 30 days, higher than 9.7% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 2.9/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2026-07-16

## Is CVE-2026-12391 being exploited?

It currently carries a trending score of 16 in the Threadlinqs vulnerability feed.

## Affected products and versions

- [Canonical](https://intel.threadlinqs.com/vendors/canonical): ubuntu-pro-client (ubuntu-advantage-tools), Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS

## How to fix CVE-2026-12391

No vendor patch reference has been recorded for CVE-2026-12391 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2026-12391

1 tracked threat in the Threadlinqs corpus references CVE-2026-12391, either in the campaign’s CVE list or as an indicator on the campaign record.

- [Critical Ubuntu Pro Client Vulnerability Enables Root Code Execution via Contract Server Spoofing (CVE-2026-11386)](https://intel.threadlinqs.com/threat/TL-2026-1564) — CRITICAL · 2026-07-20

## Sources

Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories. Last verified by Threadlinqs on 2026-10-10.

**Vulnerability database entry**

- [ubuntu.com — vdb entry](https://ubuntu.com/security/CVE-2026-12391)

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-12391
Full detection coverage and IOCs for threats exploiting CVE-2026-12391 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp