CVE-2025-15330: 
NixOS vulnerability analysis and mitigation

CVE-2025-15330 is an improper input validation and missing authorization vulnerability in Tanium Deploy that allows authenticated network attackers to bypass security restrictions. It affects Tanium Deploy versions 2.26.0 through 2.26.1278 and 2.30.0 through 2.30.174. The vulnerability was published on February 5, 2026, and a patch was made available via Tanium's security advisory TAN-2025-012. It carries a CVSS v3.1 base score of 8.8 (High) (Tanium Advisory).

The vulnerability is classified under CWE-862 (Missing Authorization) with an estimated secondary classification of CWE-20 (Improper Input Validation). An authenticated attacker with low privileges and network access can exploit insufficient authorization checks within Tanium Deploy to bypass security controls without requiring user interaction. The attack vector is network-based, requires only low privileges, and has low complexity, making it straightforward to exploit for any authenticated user on the network (Tanium Advisory).

Successful exploitation allows low-privileged authenticated users to achieve complete system compromise, with high impact to confidentiality, integrity, and availability. Attackers can gain unauthorized access to sensitive data, make unauthorized modifications to system configurations or deployments, and disrupt service availability. Given Tanium Deploy's role in enterprise endpoint management, exploitation could facilitate lateral movement across managed endpoints (Tanium Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.039%, indicating a low current probability of exploitation in the wild (Tanium Advisory).

Tanium has released patches addressing this vulnerability. Organizations running Tanium Deploy versions 2.26.0–2.26.1278 should upgrade to version 2.26.1279 or later, and those running versions 2.30.0–2.30.174 should upgrade to version 2.30.175 or later. As interim mitigations, restrict network access to Tanium Deploy to authorized users and systems only, implement network segmentation to limit exposure, and monitor Deploy instances for suspicious activity from low-privileged accounts (Tanium Advisory).

The vulnerability received limited public attention, with coverage primarily from automated vulnerability tracking services and security news aggregators. The Hacker Wire published brief coverage of the issue, and it was referenced in CISA's weekly vulnerability bulletin for the week of February 2, 2026 (CISA Bulletin). No notable researcher commentary or significant community discussion has been identified.