CVE-2025-15336
Incorrect Default Permissions in Tanium Performance Component
Publication date: 2026-02-05
Last updated on: 2026-02-10
Assigner: Tanium
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tanium | performance | From 1.17.0 (inc) to 1.17.134 (exc) |
| tanium | performance | From 1.21.0 (inc) to 1.21.141 (exc) |
| tanium | performance | From 1.22.0 (inc) to 1.22.288 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-276 | During installation, installed file permissions are set to allow anyone to modify those files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-15336 is a medium severity vulnerability in multiple Tanium modules caused by incorrect default permissions.
It allows an authenticated Tanium user with certain service account or component management permissions to read and write all platform content.
This means that users who should have limited access can potentially access and modify sensitive data across the platform.
How can this vulnerability impact me? :
This vulnerability can compromise the confidentiality and integrity of all platform content within affected Tanium modules.
An authenticated user with specific permissions could read and modify sensitive data, potentially leading to unauthorized data exposure or alteration.
However, the vulnerability does not affect the availability of the platform.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects specific versions of Tanium modules including Benchmark, Comply, Discover, Partner Integration, Patch, and Performance prior to certain update versions.
Detection involves verifying the installed versions of these Tanium modules to see if they are prior to the fixed updates.
No specific commands or network detection methods are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
The only effective mitigation is to upgrade affected Tanium modules to the fixed versions.
- For 2024H1 releases, upgrade to Update 23 or later.
- For 2024H2 releases, upgrade to Update 12 or later.
- For 2025H1 releases, upgrade to Update 6 or later.
No workarounds or alternative mitigations are available.