CVE-2026-0925: 
NixOS vulnerability analysis and mitigation

CVE-2026-0925 is an improper input validation vulnerability (CWE-1284: Improper Validation of Specified Quantity in Input) in Tanium Discover that allows high-privileged network attackers to cause a denial of service. It affects Tanium Discover versions 4.10.x before 4.10.134 and 4.15.x before 4.15.130. The vulnerability was published on January 26, 2026, with a patch advisory issued by Tanium on March 9, 2026. It carries a CVSS v3.1 base score of 4.9 (Medium) per NVD, though Tanium's own scoring (EUVD-2026-4676) rates it at 2.7 (Tanium Advisory).

The vulnerability is classified as CWE-1284 (Improper Validation of Specified Quantity in Input), meaning the application fails to properly validate a quantity-type input value before using it in a sensitive operation. An attacker with high privileges can send a specially crafted network request to Tanium Discover that triggers this improper validation, resulting in a denial-of-service condition. No authentication bypass or privilege escalation is involved — exploitation requires pre-existing high-privilege access over the network. No public proof-of-concept code or detailed technical write-up has been identified (Tanium Advisory).

Successful exploitation of CVE-2026-0925 results solely in an availability impact — specifically, a denial-of-service condition affecting the Tanium Discover module. There is no confidentiality or integrity impact, meaning sensitive data is not exposed and system configurations cannot be altered through this vulnerability. The scope is limited to the affected Discover component and does not facilitate lateral movement or broader system compromise (Tanium Advisory).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2026-0925. The EPSS score is approximately 0.053%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges, significantly limiting the attacker pool (Tanium Advisory).

Tanium has released patched versions of Discover to address this vulnerability: update to version 4.10.134 or later for the 4.10.x branch, and version 4.15.130 or later for the 4.15.x branch. Organizations should apply the patch via the Tanium platform's module update mechanism as the primary remediation. No specific configuration-based workarounds have been published; restricting high-privilege account access to the Discover module may reduce exposure until patching is complete (Tanium Advisory).