CVE-2025-15324: 
NixOS vulnerability analysis and mitigation

CVE-2025-15324 is an improper link resolution vulnerability (CWE-59, 'Link Following') in Tanium Engage that allows local low-privilege attackers to cause unauthorized file modifications and system disruption. The vulnerability affects Tanium Engage versions 1.3.0 through 1.3.36 and 1.6.0 through 1.6.192. It was published on February 5, 2026, with Tanium assigning the advisory TAN-2025-004. The CVSS v3.1 base score is 6.6 (Medium/High), with high integrity and availability impacts (Tanium Advisory).

The vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access, also known as 'Link Following'), with an estimated relationship to CWE-22 (Path Traversal). The attack vector is local, requiring low privileges and user interaction, with no change in scope. Exploitation patterns associated with this class of vulnerability include symlink attacks (CAPEC-132) and manipulation of file system calls (CAPEC-76), where an attacker places a malicious symbolic link in a location that the application resolves without proper validation, redirecting file operations to unintended targets. Tanium described the issue as a 'documentation issue in Engage,' suggesting the vulnerability may relate to undocumented or improperly documented security configuration requirements (Tanium Advisory).

Successful exploitation allows a local attacker with low privileges to achieve high integrity impact (unauthorized file modifications) and high availability impact (potential system disruption), while confidentiality is not directly affected. The attack is constrained to local access and requires user interaction, limiting the exposure scope compared to network-exploitable vulnerabilities. Affected systems running Tanium Engage in the vulnerable version ranges could experience disruption to endpoint management operations managed through the Engage module (Tanium Advisory).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed as of the time of publication. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Tanium Advisory).

Tanium has released patched versions addressing this vulnerability. Users should upgrade to Tanium Engage version 1.3.37 or later (for the 1.3.x branch) or version 1.6.193 or later (for the 1.6.x branch). As an interim measure, restricting local access to systems running vulnerable versions and monitoring for suspicious file modification activity is recommended. Full details are available in Tanium's security advisory TAN-2025-004 (Tanium Advisory).

Coverage of CVE-2025-15324 has been limited to automated vulnerability tracking platforms and aggregators. One security blog (infinitsec.net) characterized the issue as a local privilege escalation vulnerability in Tanium Engage. No notable researcher commentary, vendor statements beyond the official advisory, or significant social media discussion has been identified (Tanium Advisory).