CVE-2025-15325
Improper Input Validation in Tanium Discover Enables Potential Exploits
Publication date: 2026-02-05
Last updated on: 2026-02-10
Assigner: Tanium
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tanium | discover | to 4.10.90 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2025-15325 is an improper input validation vulnerability in the Tanium Discover service. It allows an authenticated Tanium user with the "Discover - API Execute" permission to manipulate the SQL queries executed by the Discover service.'}, {'type': 'paragraph', 'content': 'This manipulation can lead to unauthorized access or modification of data within the system.'}, {'type': 'paragraph', 'content': 'The vulnerability affects Discover versions prior to 4.10.90 and has been fixed in version 4.10.90 and later.'}] [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an authenticated user with certain permissions to manipulate SQL queries, potentially leading to unauthorized data access or modification.
Such unauthorized access or modification could compromise the confidentiality, integrity, and availability of your data, although the impact is considered low in each of these areas.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves improper input validation in the Tanium Discover service, allowing an authenticated user with specific permissions to manipulate SQL queries. Detection would require monitoring for unusual or unauthorized SQL query activity within the Discover service.
However, no specific detection commands or tools are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved in Tanium Discover version 4.10.90 and later. Immediate mitigation involves upgrading the Discover service to version 4.10.90 or a later release.
No other workarounds or mitigations are provided.