CVE-2025-15312
Improper Output Sanitization in Tanium Appliance Risks Data Exposure
Publication date: 2026-02-05
Last updated on: 2026-02-10
Assigner: Tanium
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tanium | tanos | From 1.8.3 (inc) to 1.8.3.0146 (exc) |
| tanium | tanos | From 1.8.4 (inc) to 1.8.4.0157 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-116 | The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2025-15312 is an improper output sanitization vulnerability in Tanium's TanOS operating system. This flaw allows an authenticated TanOS user to execute unauthorized code on a Tanium Appliance."}, {'type': 'paragraph', 'content': 'The vulnerability affects TanOS versions 1.8.3 prior to 1.8.3.0146 and 1.8.4 prior to 1.8.4.0157. The issue has been addressed in later versions.'}] [1]
How can this vulnerability impact me? :
This vulnerability can allow an authenticated user with high privileges to execute unauthorized code on a Tanium Appliance, potentially compromising the confidentiality, integrity, and availability of the system.
- Confidentiality impact: High
- Integrity impact: High
- Availability impact: High
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is addressed in TanOS versions 1.8.3.0146 and later, and 1.8.4.0157 and later.
Immediate steps include upgrading affected TanOS versions to these fixed versions or later.
No workarounds or other mitigations are available.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know