CVE-2025-15333: Tanium Threat Response Info Disclosure

CVE-2025-15333 Overview

CVE-2025-15333 is an information disclosure vulnerability affecting Tanium Threat Response. This security flaw allows authenticated attackers with network access to potentially expose sensitive information from the affected system. The vulnerability stems from improper default permissions (CWE-276), which could enable unauthorized users to access data they should not have visibility into.

Critical Impact

Authenticated attackers can exploit this vulnerability to disclose sensitive information from Tanium Threat Response deployments via network access.

Affected Products

• Tanium Threat Response (specific versions not disclosed)

Discovery Timeline

• February 5, 2026 - CVE CVE-2025-15333 published to NVD
• February 5, 2026 - Last updated in NVD database

Technical Details for CVE-2025-15333

Vulnerability Analysis

This information disclosure vulnerability in Tanium Threat Response is classified under CWE-276 (Incorrect Default Permissions). The flaw enables authenticated users with low privileges to access sensitive information they would not normally be authorized to view. The vulnerability requires network access but does not require user interaction to exploit successfully.

The attack complexity is low, meaning that once an attacker has valid credentials with low privileges, exploitation is straightforward. While the vulnerability is limited to confidentiality impact with no effect on integrity or availability, the exposed information could potentially be leveraged for further attacks or reconnaissance within the affected environment.

Root Cause

The root cause of CVE-2025-15333 is incorrect default permissions (CWE-276) within the Tanium Threat Response component. Default permissions that are overly permissive allow authenticated users to access resources or data beyond their intended authorization level. This type of misconfiguration typically occurs when access control mechanisms fail to properly restrict data visibility based on user privilege levels.

Attack Vector

The vulnerability is exploitable over the network by authenticated users. An attacker would need valid credentials with at least low-level privileges to the Tanium Threat Response system. Once authenticated, the attacker can leverage the improper permission configuration to access and disclose sensitive information that should be restricted.

The attack does not require any user interaction, and the scope remains unchanged, meaning the vulnerability affects only the vulnerable component itself without impacting other components in the system.

Detection Methods for CVE-2025-15333

Indicators of Compromise

• Unusual data access patterns from low-privileged user accounts in Tanium Threat Response logs
• Unexpected API calls or queries to sensitive data endpoints by users without appropriate roles
• Anomalous authentication activity followed by information retrieval requests

Detection Strategies

• Monitor Tanium Threat Response access logs for users accessing data outside their normal scope
• Implement alerts for permission escalation attempts or access control violations
• Review audit logs for unusual patterns of information retrieval by authenticated users

Monitoring Recommendations

• Enable comprehensive logging for all data access events within Tanium Threat Response
• Configure SIEM rules to detect abnormal data access patterns from low-privileged accounts
• Regularly audit user permissions and access control configurations

How to Mitigate CVE-2025-15333

Immediate Actions Required

• Review the Tanium Security Advisory TAN-2025-025 for specific remediation guidance
• Audit current user permissions within Tanium Threat Response to identify overly permissive configurations
• Restrict network access to Tanium Threat Response to authorized personnel only
• Review and tighten access control policies for all user accounts

Patch Information

Tanium has addressed this vulnerability as documented in Security Advisory TAN-2025-025. Organizations should consult the advisory for specific patch details and apply the recommended updates to remediate this vulnerability.

Workarounds

• Implement network segmentation to limit access to Tanium Threat Response to trusted networks only
• Apply the principle of least privilege by reviewing and restricting user permissions
• Enable additional logging and monitoring to detect potential exploitation attempts
• Consider implementing additional authentication controls until patches can be applied