{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0925", "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512", "state": "PUBLISHED", "assignerShortName": "Tanium", "dateReserved": "2026-01-13T20:48:10.968Z", "datePublished": "2026-01-26T17:51:34.091Z", "dateUpdated": "2026-02-02T20:01:37.786Z"}, "containers": {"cna": {"affected": [{"product": "Discover", "vendor": "Tanium", "versions": [{"version": "4.10", "status": "affected", "lessThan": "4.10.134", "versionType": "custom"}, {"version": "4.15", "status": "affected", "lessThan": "4.15.130", "versionType": "custom"}], "cpes": ["cpe:2.3:a:tanium:service_asset:4.10.133:*:*:*:*:*:*:*", "cpe:2.3:a:tanium:service_asset:4.15.129:*:*:*:*:*:*:*"]}], "dateAssigned": "2026-01-13T20:48:10.331Z", "datePublic": "2026-01-24T01:37:51.794Z", "descriptions": [{"lang": "en", "value": "Tanium addressed an improper input validation vulnerability in Discover."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 2.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1284", "description": "Improper Validation of Specified Quantity in Input", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512", "shortName": "Tanium", "dateUpdated": "2026-02-02T20:01:37.786Z"}, "references": [{"name": "TAN-2026-002", "url": "https://security.tanium.com/TAN-2026-002"}], "title": "Tanium addressed an improper input validation vulnerability in Discover."}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T19:50:33.379257Z", "id": "CVE-2026-0925", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T19:50:46.864Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0925", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T19:50:33.379257Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T19:50:42.829Z"}}], "cna": {"title": "Tanium addressed an improper input validation vulnerability in Discover.", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 2.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"}}], "affected": [{"cpes": ["cpe:2.3:a:tanium:service_asset:4.10.133:*:*:*:*:*:*:*", "cpe:2.3:a:tanium:service_asset:4.15.129:*:*:*:*:*:*:*"], "vendor": "Tanium", "product": "Discover", "versions": [{"status": "affected", "version": "4.10", "lessThan": "4.10.134", "versionType": "custom"}, {"status": "affected", "version": "4.15", "lessThan": "4.15.130", "versionType": "custom"}]}], "datePublic": "2026-01-24T01:37:51.794Z", "references": [{"url": "https://security.tanium.com/TAN-2026-002", "name": "TAN-2026-002"}], "dateAssigned": "2026-01-13T20:48:10.331Z", "descriptions": [{"lang": "en", "value": "Tanium addressed an improper input validation vulnerability in Discover."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "Improper Validation of Specified Quantity in Input"}]}], "providerMetadata": {"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512", "shortName": "Tanium", "dateUpdated": "2026-02-02T20:01:37.786Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0925", "state": "PUBLISHED", "dateUpdated": "2026-02-02T20:01:37.786Z", "dateReserved": "2026-01-13T20:48:10.968Z", "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512", "datePublished": "2026-01-26T17:51:34.091Z", "assignerShortName": "Tanium"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tanium:discover:*:*:*:*:*:*:*:*", "matchCriteriaId": "F71FE26F-8FE6-4982-9018-8742B1DFC0F6", "versionEndExcluding": "4.10.134", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:tanium:discover:*:*:*:*:*:*:*:*", "matchCriteriaId": "B88BAB1D-6C10-4EBA-885D-94BA6F162BC9", "versionEndExcluding": "4.15.130", "versionStartIncluding": "4.15", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tanium addressed an improper input validation vulnerability in Discover."}, {"lang": "es", "value": "Tanium abord\u00f3 una vulnerabilidad de validaci\u00f3n de entrada incorrecta en Discover."}], "id": "CVE-2026-0925", "lastModified": "2026-03-09T18:10:26.780", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "3938794e-25f5-4123-a1ba-5cbd7f104512", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-01-26T18:16:28.457", "references": [{"source": "3938794e-25f5-4123-a1ba-5cbd7f104512", "tags": ["Vendor Advisory"], "url": "https://security.tanium.com/TAN-2026-002"}], "sourceIdentifier": "3938794e-25f5-4123-a1ba-5cbd7f104512", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1284"}], "source": "3938794e-25f5-4123-a1ba-5cbd7f104512", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:01:04.090534+00:00", "value": {"mitigation_remediation": ["Apply the latest Tanium Discover patch that resolves CVE-2026\u20110925.", "Upgrade Tanium Service Asset to a version that includes the fix for releases 4.10.133 and 4.15.129.", "Ensure that input validation controls are active on all exposed interfaces and APIs that interact with Discover, and restrict access to these endpoints to authorized users only."], "summary": {"action": "Patch", "impact": "Unintended Behavior"}, "threat_synthesis": {"affected_systems": "The flaw affects Tanium Discover in all deployed versions, as the CPE indicates no version restriction. For Tanium Service Asset, the specified affected releases are 4.10.133 and 4.15.129. Administrators should verify the exact product versions in use and apply any available patches or newer releases that contain the fix.", "description_and_impact": "Tanium has reported an improper input validation flaw in its Discover component, classified as CWE\u20111284. The defect allows data that is not properly checked to enter the system, potentially leading to unpredicted application behavior such as data corruption or erratic responses. The CVSS score of 2.7 indicates a low severity, suggesting that the vulnerability is unlikely to provide a direct compromise path but can still produce operational disruptions if exploited. Based on the description, it is inferred that the attacker could craft input that triggers misprocessing, causing unintended state changes within the platform.", "risk_and_exploitability": "With a CVSS score of 2.7 and an EPSS probability of less than 1%, the likelihood of exploitation is very low and no public exploits are known. The vulnerability is not listed in the CISA KEV catalog, reinforcing its low threat profile. The likely attack vector involves supplying malformed or specially crafted input through a user\u2011facing interface or API, which typically requires authenticated or privileged access to the Tanium platform. Consequently, while the risk remains low, it is prudent to remediate the issue promptly."}}}}, "created": "2026-01-27T09:03:31.382670+00:00", "updated": "2026-04-18T15:15:03.683668+00:00", "vendors": ["tanium", "tanium$PRODUCT$tanium"]}