CVE-2025-15333
Information Disclosure Vulnerability in Tanium Threat Response
Publication date: 2026-02-05
Last updated on: 2026-02-10
Assigner: Tanium
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tanium | threat_response | From 4.5.0 (inc) to 4.5.266 (exc) |
| tanium | threat_response | From 4.6.0 (inc) to 4.6.536 (exc) |
| tanium | threat_response | From 4.9.0 (inc) to 4.9.324 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-276 | During installation, installed file permissions are set to allow anyone to modify those files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2025-15333 is an information disclosure vulnerability in Tanium Threat Response. It affects versions prior to certain updates in 2024 and 2025. The vulnerability allows an authenticated Tanium user who has the "Threat Response Sources - Write" permission to gain unauthorized read-only access to data beyond what they are normally allowed to see.'}] [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive information because users with certain permissions can access data outside their intended scope. Although the access is read-only, it may expose confidential or sensitive data, potentially leading to information leakage within an organization.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update Tanium Threat Response to the fixed versions: Update 22 (v4.5.266) for 2024H1, Update 11 (v4.6.536) for 2024H2, or Update 5 (v4.9.324) for 2025H1 or later.
There are no available workarounds or mitigations other than applying these updates.