CVE-2025-15289: 
NixOS vulnerability analysis and mitigation

CVE-2025-15289 is an improper access controls vulnerability (Missing Authorization) in Tanium Interact that allows authenticated low-privilege attackers to access confidential information without proper authorization. It affects Tanium Interact versions 3.1.0 through 3.1.336, 3.2.0 through 3.2.184, and 3.5.0 through 3.5.89. The vulnerability was published on February 5, 2026, and Tanium has released patches addressing the issue. It carries a CVSS v3.1 base score of 3.1 (Low) (Tanium Advisory).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the application fails to perform adequate authorization checks before granting access to certain resources or functionality within the Interact platform. Exploitation requires network access, low-level authenticated privileges, and higher attack complexity, but no user interaction is needed. The scope is unchanged, and only confidentiality is impacted. No public technical write-ups or proof-of-concept code have been identified (Tanium Advisory).

Successful exploitation allows an authenticated attacker with low privileges to access confidential information within the Tanium Interact platform without proper authorization. The confidentiality impact is rated as low, with no integrity or availability impact. There is no evidence of lateral movement potential or broader system compromise based on available information (Tanium Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed. The EPSS score is approximately 0.025%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Tanium Advisory).

Tanium has released patched versions addressing this vulnerability. Affected organizations should upgrade Tanium Interact to one of the following versions or later: 3.1.337, 3.2.185, or 3.5.90. Additionally, organizations should review access controls and audit logs for unauthorized access attempts, restrict network access to Interact to only necessary personnel, and monitor for suspicious activity from authenticated users attempting to access data outside their authorization scope (Tanium Advisory).