Tanium 修复了 Tanium Appliance 中的不当证书验证漏洞。

The improper certificate validation vulnerability allows an attacker to potentially bypass security controls and gain unauthorized access to the Tanium Appliance. Successful exploitation could lead to data breaches, system compromise, and disruption of operations. While the CVSS score is LOW, the potential impact on a critical security management platform warrants immediate attention and remediation. The ability to bypass certificate validation opens the door to man-in-the-middle attacks and the injection of malicious certificates, potentially granting attackers elevated privileges within the Tanium environment.

Organizations heavily reliant on Tanium Appliance for endpoint visibility and management are at risk. This includes those with complex network architectures or those who have not implemented robust certificate management practices. Shared hosting environments utilizing Tanium Appliance are also potentially vulnerable.

1. 2026-02-05Disclosure

   disclosure

1. 已保留2025-12-29
2. 发布日期2026-02-05
3. 修改日期2026-02-06
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-15323 is to upgrade Tanium Appliance to version 1.8.5.0236 or later, which contains the fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing stricter certificate pinning policies within the Tanium environment to limit the acceptance of untrusted certificates. Review and strengthen existing network security controls, including firewalls and intrusion detection systems, to detect and prevent potential exploitation attempts. Regularly audit certificate configurations to ensure compliance with security best practices.