CVE-2025-15326: 
NixOS vulnerability analysis and mitigation

CVE-2025-15326 is an improper access controls vulnerability (Missing Authorization, CWE-862) in Tanium Patch that allows low-privileged authenticated users to read sensitive data over the network without user interaction. It affects Tanium Patch versions 3.17.0 through 3.17.2261 and 3.19.0 through 3.19.194. The vulnerability was published on February 5, 2026, with a patch advisory issued by Tanium. It carries a CVSS v3.1 base score of 4.3 (Medium) (Tanium Advisory).

The root cause is classified as CWE-862 (Missing Authorization), meaning the application fails to properly enforce authorization checks before granting access to sensitive resources within the Tanium Patch module. The attack vector is network-based, requiring only low-level authenticated access with no user interaction and no elevated privileges. An attacker with valid low-privileged credentials can send crafted requests to Tanium Patch endpoints to retrieve sensitive data that should be restricted to higher-privileged roles (Tanium Advisory).

Successful exploitation allows a low-privileged authenticated attacker to access confidential information within Tanium Patch remotely, resulting in a limited confidentiality impact. There is no integrity or availability impact associated with this vulnerability. While the scope is unchanged and lateral movement potential is limited, exposure of sensitive patch management data could aid attackers in further reconnaissance or privilege escalation within the environment (Tanium Advisory).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Tanium Advisory).

Tanium has released patched versions addressing this vulnerability. Users running Tanium Patch 3.17.0–3.17.2261 should upgrade to version 3.17.2262 or later; users running 3.19.0–3.19.194 should upgrade to version 3.19.195 or later. As interim mitigations, organizations should implement network access controls to restrict connectivity to Tanium Patch systems from untrusted networks, enforce the principle of least privilege for user accounts, and monitor access logs for suspicious activity from authenticated users (Tanium Advisory).