Tanium vulnerabilities and threats

CVE-2026-6416 is a low-severity vulnerability in Tanium Interact that involves uncontrolled resource consumption. The vulnerability affects versions 3.2.0, 3.5.0, and 3.8.0 of the product. Tanium has acknowledged the issue but no specific patch or remediation details are provided in the available data. The vulnerability does not impact confidentiality or integrity but may cause availability degradation due to resource exhaustion.

Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS.

Tanium addressed an insertion of sensitive information into log file vulnerability in Trends.

Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS.

Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension.

Tanium addressed a SQL injection vulnerability in Asset.

Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal.

CVE-2025-15314 is a medium severity vulnerability in Tanium's end-user-cx product that allows an authenticated local attacker to cause arbitrary file deletion due to improper link resolution before file access. The flaw arises from 'link following' issues where symbolic or hard links are not properly handled, enabling an attacker with low privileges to delete files they should not be able to. Exploitation does not require user interaction but does require local privileges. The vulnerability impacts versions 1.4.0, 1.6.0, and 1.8.0 of end-user-cx.

CVE-2025-15313 is a medium-severity vulnerability in Tanium EUSS versions 1.17.0 and 1.18.0 that allows an authenticated user with low privileges to cause improper link resolution before file access, leading to arbitrary file deletion. The flaw does not require user interaction and affects the integrity of the system by enabling deletion of files without proper authorization checks. There are no known exploits in the wild as of now. The vulnerability is local access only, requiring low privileges, which limits its exploitation scope but still poses a risk to organizations using affected Tanium EUSS versions. European organizations relying on Tanium for endpoint security and systems management should prioritize patching to prevent potential misuse. Countries with higher adoption of Tanium products and critical infrastructure sectors are more likely to be impacted.

CVE-2025-15310 is a high-severity local privilege escalation vulnerability in Tanium Patch Endpoint Tools affecting versions 3.17.0, 10.1.0, and 10.2.0. The flaw arises from improper link resolution before file access, commonly known as 'link following,' which allows a local attacker with limited privileges to escalate their rights. This vulnerability does not require user interaction but does require local access and low attack complexity. Exploitation could lead to full confidentiality, integrity, and availability compromise on affected systems.

CVE-2025-15318 is a medium-severity vulnerability in Tanium's End-User Notifications Endpoint Tools that allows an authenticated local attacker to cause improper link resolution before file access, leading to arbitrary file deletion. The flaw arises from insufficient validation of symbolic links, enabling an attacker with low privileges to delete files they should not have access to. Exploitation does not require user interaction but does require local privileges. While no known exploits are currently in the wild, affected versions include 1.18.0, 10.0.0, and 10.1.0.

CVE-2025-15319 is a high-severity local privilege escalation vulnerability in Tanium Patch Endpoint Tools affecting multiple versions. The flaw arises from improper link resolution before file access, allowing an attacker with limited privileges to escalate their rights on the system. Exploitation requires local access and no user interaction, potentially leading to full confidentiality, integrity, and availability compromise. Although no known exploits are currently in the wild, the vulnerability's impact is significant due to the critical nature of Tanium's endpoint management tools. European organizations using affected versions should prioritize patching to mitigate risk. Countries with high adoption of Tanium solutions and critical infrastructure sectors are most at risk. Mitigations include applying vendor patches promptly, restricting local user permissions, and monitoring for suspicious local activity. The vulnerability carries a CVSS score of 7.8, reflecting its high severity and ease of exploitation given local access. Defenders should focus on rapid detection and remediation to prevent privilege escalation attacks leveraging this flaw.

CVE-2025-15315 is a local privilege escalation vulnerability in the Tanium Module Server caused by improper neutralization of argument delimiters leading to argument injection. It affects specific versions of Tanium Module Server (7.4.6.0, 7.5.6.0, 7.6.2.

CVE-2025-15316 is a local privilege escalation vulnerability in Tanium Server caused by improper neutralization of argument delimiters, enabling argument injection. It affects multiple versions of Tanium Server (7.4.6.0, 7.5.6.0, 7.6.2.

CVE-2025-15317 is a medium severity vulnerability in Tanium Server versions 7.4.6.0, 7.5.6.0, 7.6.2.0, and 7.

Tanium addressed a denial of service vulnerability in Tanium Client.

Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.

Tanium addressed an improper output sanitization vulnerability in Tanium Appliance.

Tanium addressed a documentation issue in Engage.

Tanium addressed an improper input validation vulnerability in Discover.