CVE-2025-15288: 
NixOS vulnerability analysis and mitigation

CVE-2025-15288 is an improper access control vulnerability (CWE-863: Incorrect Authorization) in Tanium Interact that allows authenticated low-privilege users to access confidential information over the network. It affects Tanium Interact versions 3.5.0 through 3.5.89. The vulnerability was published on January 29, 2026, with a patch released under Tanium security advisory TAN-2025-034. It carries a CVSS v3.1 base score of 4.3 (Medium) per NVD, while the vendor's own scoring places it at 3.1 (Low) (Tanium Advisory).

The vulnerability is classified as CWE-863 (Incorrect Authorization), meaning the application fails to properly verify that an authenticated user has the appropriate permissions before granting access to certain resources within Tanium Interact. An attacker with low-privilege network access can exploit this flaw to retrieve confidential information they should not be authorized to view. No user interaction is required, and the attack vector is network-based, though the vendor's scoring notes high attack complexity. No public technical write-ups or proof-of-concept code have been identified (Tanium Advisory).

Successful exploitation results in a limited confidentiality breach — an authenticated low-privilege attacker could access information within Tanium Interact that they are not authorized to view. There is no impact to system integrity or availability, and the scope is confined to the affected Tanium Interact instance. Given Tanium's role as an endpoint management platform, unauthorized access to query results or endpoint data could still expose sensitive organizational information (Tanium Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is extremely low at approximately 0.009%, reflecting minimal likelihood of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Tanium Advisory).

Tanium has released a patch in Interact version 3.5.90, which resolves this vulnerability. Organizations running Tanium Interact versions 3.5.0 through 3.5.89 should upgrade to version 3.5.90 or later as the primary remediation step. As interim measures, administrators should restrict network access to Tanium Interact to only authorized users, enforce proper role-based access control (RBAC) configurations, and monitor access logs for suspicious authentication activity from low-privilege accounts (Tanium Advisory).