CVE-2025-15335: Tanium Threat Response Disclosure Flaw

CVE-2025-15335 Overview

CVE-2025-15335 is an information disclosure vulnerability affecting Tanium Threat Response. This security flaw allows authenticated attackers with network access to potentially expose sensitive information due to improper permission handling within the affected component.

Critical Impact

Authenticated attackers can exploit this vulnerability to access sensitive information that should be restricted, potentially compromising the confidentiality of protected data within Tanium Threat Response environments.

Affected Products

• Tanium Threat Response (specific versions detailed in vendor advisory)

Discovery Timeline

• February 5, 2026 - CVE-2025-15335 published to NVD
• February 5, 2026 - Last updated in NVD database

Technical Details for CVE-2025-15335

Vulnerability Analysis

This information disclosure vulnerability in Tanium Threat Response stems from incorrect default permissions (CWE-276). The vulnerability is exploitable over the network with low attack complexity, though it requires the attacker to have low-level privileges on the system. Successful exploitation results in unauthorized access to sensitive information, impacting the confidentiality of data within the affected deployment.

The vulnerability does not require user interaction, making it particularly concerning in environments where attackers may have already established a foothold with limited privileges. While the vulnerability does not affect system integrity or availability directly, the disclosed information could be leveraged for further attacks.

Root Cause

The root cause of CVE-2025-15335 is CWE-276: Incorrect Default Permissions. This weakness occurs when software installs or configures resources with permissions that provide more access than required, allowing unauthorized actors to read sensitive data. In the context of Tanium Threat Response, this manifests as improperly configured access controls that fail to adequately restrict information access to authorized users only.

Attack Vector

The attack vector for this vulnerability is network-based, meaning an attacker with network access to the vulnerable Tanium Threat Response component can exploit this flaw. The attacker needs valid credentials with low-level privileges to access the system. Once authenticated, the attacker can leverage the incorrect permissions to access information that should be restricted to higher-privileged users or specific roles.

The exploitation does not require any user interaction, and the scope is unchanged, meaning the vulnerability only affects resources managed by the same security authority. For technical details regarding specific exploitation scenarios, refer to the Tanium Security Advisory TAN-2025-027.

Detection Methods for CVE-2025-15335

Indicators of Compromise

• Unusual access patterns to Tanium Threat Response resources from authenticated users with limited privileges
• Access logs showing repeated queries or data retrieval requests that exceed normal user activity patterns
• Authentication events followed by access to sensitive data stores or configuration files

Detection Strategies

• Monitor Tanium Threat Response access logs for anomalous information retrieval patterns
• Implement user behavior analytics to identify privilege abuse scenarios
• Review audit logs for authenticated users accessing data outside their normal operational scope
• Deploy network traffic analysis to detect unusual data exfiltration patterns from Threat Response components

Monitoring Recommendations

• Enable detailed audit logging within Tanium Threat Response environments
• Configure alerting for access attempts to sensitive data repositories
• Implement real-time monitoring of user session activities within the Tanium console
• Regularly review access control configurations and permission assignments

How to Mitigate CVE-2025-15335

Immediate Actions Required

• Review the Tanium Security Advisory TAN-2025-027 for detailed patching guidance
• Audit current user permissions within Tanium Threat Response to identify overly permissive configurations
• Implement network segmentation to limit access to Tanium Threat Response components
• Monitor for suspicious access patterns while preparing to apply the security update

Patch Information

Tanium has addressed this vulnerability in a security update. Organizations should consult the Tanium Security Advisory TAN-2025-027 for specific patch details, affected version information, and upgrade instructions. It is recommended to apply the security update as soon as possible following your organization's change management procedures.

Workarounds

• Restrict network access to Tanium Threat Response components using firewall rules or network segmentation
• Review and tighten user permissions to follow the principle of least privilege
• Implement additional authentication controls such as multi-factor authentication for accessing sensitive Tanium components
• Monitor access logs closely until the official patch can be applied