CVE-2025-15325: 
NixOS vulnerability analysis and mitigation

CVE-2025-15325 is an SQL Injection vulnerability (improper neutralization of special elements used in an SQL command) in Tanium Discover, a network asset discovery module within the Tanium platform. The vulnerability affects Tanium Discover versions prior to 4.10.90 and was disclosed on February 5, 2026. Tanium assigned this vulnerability and addressed it in their security advisory TAN-2025-005. It carries a CVSS v3.1 base score of 6.3 (Medium/High) (Tanium Advisory).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command — SQL Injection), with an estimated root cause of CWE-20 (Improper Input Validation). An authenticated attacker with low privileges can send crafted network requests to the Tanium Discover module, injecting malicious SQL syntax into insufficiently validated input fields. No user interaction is required, and the attack complexity is low, making it straightforward to exploit once authenticated. Relevant attack patterns include blind SQL injection (CAPEC-7), command-line execution through SQL injection (CAPEC-108), and ORM injection (CAPEC-109) (Tanium Advisory).

Successful exploitation could result in limited but meaningful impacts across confidentiality, integrity, and availability — each rated as low in the CVSS scoring. An attacker could read sensitive data from the underlying database, modify data, or cause partial disruption to the Discover service. In enterprise environments where Tanium Discover is used for network asset visibility, unauthorized database access could expose asset inventory data and potentially facilitate further lateral movement within the environment (Tanium Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-15325. The EPSS score is approximately 0.041%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-privilege authenticated access to the Tanium platform, which limits the attacker pool but does not eliminate insider or post-compromise risk (Tanium Advisory).

Tanium has released a patch addressing this vulnerability in Tanium Discover version 4.10.90 and later. Organizations should upgrade the Discover module to version 4.10.90 or above as the primary remediation step. Until patching is complete, restricting access to the Tanium platform to only authorized and necessary personnel can reduce exposure. Review Tanium's official security advisory TAN-2025-005 for additional guidance (Tanium Advisory).