Cyber Resilience

CVE-2026-0925

Tanium Discover 4.10 – 4.10.134

Published
26 January 2026
Modified
09 March 2026
Patch / advisory
View advisory
CVSS Score v3.1 2.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0039 31th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-0925 is a low-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Tanium Discover. Its CVSS base score is 2.7 (Low).

Operationally, ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Tanium addressed an improper input validation vulnerability in Discover.

CWE(s)
CWE-1284

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-15339Same product: Tanium Discover
CVE-2026-1224Same product: Tanium Discover
CVE-2025-15325Same product: Tanium Discover
CVE-2025-15315Same vendor: Tanium
CVE-2025-15319Same vendor: Tanium
CVE-2025-15314Same vendor: Tanium
CVE-2025-15330Same vendor: Tanium
CVE-2025-13225Same vendor: Tanium
CVE-2025-15326Same vendor: Tanium
CVE-2025-15317Same vendor: Tanium

Affected Assets

tanium
discover
4.10 — 4.10.134 · 4.15 — 4.15.130

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
  • SI-2 Flaw Remediation
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V6.7.2
  • V1.4.2
  • V2.1.1
  • V2.2.1

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of all input quantities and formats, which would have blocked exploitation of the CWE-1284 flaw in Tanium Discover.

SI-7 Software, Firmware, and Information Integrity partial match
detect

Requires integrity checks on software and inputs that can detect malformed data resulting from improper quantity validation.

SI-2 Flaw Remediation partial match
respondrecover

Mandates timely remediation of identified input-validation flaws such as the one corrected in this CVE.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require proper quantity/length validation in input handling.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development can detect missing quantity validation but does not itself implement the control.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle mandates input validation for quantity fields, directly preventing CWE-1284.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly call for validation of size/length inputs, mitigating CWE-1284.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles encourage robust input handling but do not specifically address quantity validation.

A.8.28 Secure coding partial match
prevents

Secure coding standards require explicit checks on numeric quantity inputs, fully addressing CWE-1284.

References