CVE-2025-15337: 
NixOS vulnerability analysis and mitigation

CVE-2025-15337 is an incorrect default permissions vulnerability (CWE-276) in Tanium Patch that allows high-privileged authenticated users to access sensitive data and modify system configurations without proper authorization controls. It affects Tanium Patch versions 3.17.0–3.17.2299, 3.19.0–3.19.231, and 3.24.0–3.24.136. The vulnerability was published on February 5, 2026, and addressed by Tanium in advisory TAN-2025-029. It carries a CVSS v3.1 base score of 6.5 (Medium) (Tanium Advisory).

The root cause is CWE-276 (Incorrect Default Permissions), where Tanium Patch ships with overly permissive default access controls that fail to properly restrict what high-privileged users can access or modify. The attack vector is network-based, requires high privileges, and no user interaction, meaning an authenticated administrator or service account could exploit the misconfigured permissions to reach resources or configurations that should be further restricted. No public proof-of-concept or detailed technical write-up has been identified at this time (Tanium Advisory).

Successful exploitation allows high-privileged authenticated users to access sensitive data and modify system configurations beyond their intended authorization scope, resulting in high confidentiality and integrity impact with no availability impact. Because Tanium Patch is an enterprise endpoint management component, compromise could expose patch deployment configurations, managed endpoint data, or allow unauthorized configuration changes across managed systems. Lateral movement risk is elevated given Tanium's broad reach across enterprise endpoints (Tanium Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.021%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high-privilege authentication, which limits the attacker pool but does not eliminate insider threat or compromised admin account scenarios (Tanium Advisory).

Tanium has released patched versions addressing this vulnerability. Affected organizations should upgrade to the following fixed versions as soon as possible:

• 3.17.x branch: Upgrade to Tanium Patch 3.17.2300 or later
• 3.19.x branch: Upgrade to Tanium Patch 3.19.232 or later
• 3.24.x branch: Upgrade to Tanium Patch 3.24.137 or later

Prior to patching, organizations should review and restrict high-privilege account access to the minimum necessary, enforce the principle of least privilege for administrative accounts, and monitor logs for suspicious activity from high-privilege accounts accessing sensitive data or modifying configurations (Tanium Advisory).