CVE-2025-15339: 
NixOS vulnerability analysis and mitigation

CVE-2025-15339 is an incorrect default permissions vulnerability in Tanium Discover, a network asset discovery module within the Tanium platform. The vulnerability allows high-privileged users to access sensitive data without proper authorization checks. It affects Tanium Discover versions 4.10.0 through 4.10.118 (exclusive), and was published on February 5, 2026. The CVSS v3.1 base score is 6.5 (Medium), though Feedly's category estimate rates it as High (Tanium Advisory).

The root cause is classified as CWE-276 (Incorrect Default Permissions), where Tanium Discover ships with overly permissive default access controls that fail to properly restrict sensitive functionality to authorized roles. An attacker with high-privileged (administrative) network access can exploit these misconfigured permissions to read or modify data that should be restricted, without requiring user interaction. The attack vector is network-based with low complexity, requiring no user interaction but necessitating high privileges as a precondition. No public proof-of-concept exploit code has been identified (Tanium Advisory).

Successful exploitation results in high confidentiality and high integrity impact, with no availability impact. An insider or compromised high-privileged account could access sensitive asset discovery data and potentially modify it, undermining the accuracy of Tanium's network visibility. The scope is unchanged, meaning impact is confined to the Tanium Discover component itself, but exposure of asset inventory data could facilitate further lateral movement or targeted attacks within the environment (Tanium Advisory).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2025-15339. The EPSS score is approximately 0.021% (0.000210), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges, significantly limiting the attacker pool to insiders or accounts already compromised at an administrative level (Tanium Advisory).

Tanium has released a patch addressing this vulnerability; users should upgrade Tanium Discover to version 4.10.118 or later. Organizations should review and audit role-based access controls within Tanium Discover to ensure permissions align with the principle of least privilege. Until patching is complete, restricting administrative access to Tanium Discover to only trusted personnel and monitoring for anomalous access patterns is recommended (Tanium Advisory).