CVE-2025-15311
Published: 05 February 2026
Summary
CVE-2025-15311 is a high-severity Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150) vulnerability in Tanium Tanos. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific unauthorized code execution flaw in the Tanium Appliance software by identifying, reporting, and applying patches as provided in TAN-2025-002.
Protects system memory from unauthorized code execution exploits like this local low-privilege vulnerability through safeguards such as address space layout randomization and data execution prevention.
Enforces least privilege to limit the capabilities of low-privileged local accounts that could exploit the vulnerability for high-impact code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local low-priv unauthorized code execution vulnerability directly maps to exploitation for privilege escalation.
NVD Description
Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.
Deeper analysisAI
CVE-2025-15311 is an unauthorized code execution vulnerability (CWE-150) in the Tanium Appliance. Published on 2026-02-05, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Tanium has addressed the issue in their appliance software.
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction. Successful exploitation enables high-impact unauthorized code execution, compromising confidentiality, integrity, and availability of the affected system.
Tanium's security advisory TAN-2025-002, available at https://security.tanium.com/TAN-2025-002, provides details on patches and mitigation steps.
Details
- CWE(s)