CVE-2025-15327: 
NixOS vulnerability analysis and mitigation

CVE-2025-15327 is an improper access control (missing authorization) vulnerability in Tanium Deploy that allows authenticated low-privilege users to access sensitive data without proper authorization checks. It was published on February 5, 2026, and assigned by Tanium. Affected versions include Tanium Deploy 2.26.0 through 2.26.1252 and 2.30.0 through 2.30.149. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Tanium Advisory).

The root cause is classified as CWE-862 (Missing Authorization), meaning the application fails to perform adequate authorization checks before granting access to sensitive resources within the Deploy module. An authenticated attacker with low-privilege network credentials can send requests to restricted endpoints and retrieve sensitive information without being explicitly authorized to do so. No user interaction is required, and the attack complexity is low, making it straightforward to exploit given valid credentials. No public technical write-ups or proof-of-concept code have been identified (Tanium Advisory).

Successful exploitation allows a low-privilege authenticated attacker to read and disclose sensitive information from Tanium Deploy systems over the network. Only confidentiality is impacted — system integrity and availability remain unaffected. The scope is limited to the affected Tanium Deploy instance, with no evidence of lateral movement potential or broader infrastructure compromise based on current information (Tanium Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.025%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Tanium Advisory).

Tanium has released patched versions addressing this vulnerability. Organizations should upgrade Tanium Deploy to version 2.26.1253 or later (for the 2.26.x branch) or to version 2.30.150 or later (for the 2.30.x branch). As interim mitigations, restrict network access to Tanium Deploy systems to authorized users and networks only, and enforce the principle of least privilege for all user accounts. Monitor for unauthorized access attempts or anomalous data disclosure activity on affected systems (Tanium Advisory).