CVE-2025-15325
Unknown Unknown - Not Provided
Improper Input Validation in Tanium Discover Enables Potential Exploits

Publication date: 2026-02-05

Last updated on: 2026-02-10

Assigner: Tanium

Description
Tanium addressed an improper input validation vulnerability in Discover.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-05
Last Modified
2026-02-10
Generated
2026-06-16
AI Q&A
2026-02-05
EPSS Evaluated
2026-06-15
NVD
CVE-2025-15325
EUVD
EUVD-2025-206832
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
tanium discover to 4.10.90 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2025-15325 is an improper input validation vulnerability in the Tanium Discover service. It allows an authenticated Tanium user with the "Discover - API Execute" permission to manipulate the SQL queries executed by the Discover service.'}, {'type': 'paragraph', 'content': 'This manipulation can lead to unauthorized access or modification of data within the system.'}, {'type': 'paragraph', 'content': 'The vulnerability affects Discover versions prior to 4.10.90 and has been fixed in version 4.10.90 and later.'}] [1]

Impact Analysis

This vulnerability can impact you by allowing an authenticated user with certain permissions to manipulate SQL queries, potentially leading to unauthorized data access or modification.

Such unauthorized access or modification could compromise the confidentiality, integrity, and availability of your data, although the impact is considered low in each of these areas.

Compliance Impact

I don't know

Detection Guidance

This vulnerability involves improper input validation in the Tanium Discover service, allowing an authenticated user with specific permissions to manipulate SQL queries. Detection would require monitoring for unusual or unauthorized SQL query activity within the Discover service.

However, no specific detection commands or tools are provided in the available information.

Mitigation Strategies

The vulnerability is resolved in Tanium Discover version 4.10.90 and later. Immediate mitigation involves upgrading the Discover service to version 4.10.90 or a later release.

No other workarounds or mitigations are provided.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15325. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart