CVE-2025-13225
CVE-2025-13225 is a medium-severity vulnerability in Tanium Tanos with a CVSS 3.x base score of 5.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-552.
Key facts
- Severity: Medium (CVSS 3.x base score 5.6)
- EPSS exploit prediction: 0% (5th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-198130
- Weakness: CWE-552
- Affected product: Tanium Tanos
- Published:
- Last modified:
Description
Tanium addressed an arbitrary file deletion vulnerability in TanOS.
Frequently asked questions
- What is CVE-2025-13225?
- Tanium addressed an arbitrary file deletion vulnerability in TanOS.
- How severe is CVE-2025-13225?
- CVE-2025-13225 has a CVSS 3.x base score of 5.6, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.
- Is CVE-2025-13225 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-13225?
- CVE-2025-13225 affects Tanium Tanos. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-13225?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-13225 have an EU (EUVD) identifier?
- Yes. CVE-2025-13225 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-198130.
- When was CVE-2025-13225 published?
- CVE-2025-13225 was published on 2025-11-19 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:o:tanium:tanos:*:*:*:*:*:*:*:*
More vulnerabilities in Tanium Tanos
- CVE-2025-15311 — High (CVSS 7.8): Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.
- CVE-2025-15312 — Medium (CVSS 6.6): Tanium addressed an improper output sanitization vulnerability in Tanium Appliance.
- CVE-2026-2605 — Medium (CVSS 5.3): Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS.
- CVE-2025-15323 — Low (CVSS 3.7): Tanium addressed an improper certificate validation vulnerability in Tanium Appliance.
- CVE-2025-15321 — Low (CVSS 2.7): Tanium addressed an improper input validation vulnerability in Tanium Appliance.
All CVEs affecting Tanium Tanos →
Other CWE-552 (Files or Directories Accessible to External Parties) vulnerabilities
- CVE-2025-41240 — Critical (CVSS 10.0): Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located…
- CVE-2024-56731 — Critical (CVSS 10.0): Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the…
- CVE-2024-6209 — Critical (CVSS 10.0): Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series…
- CVE-2025-14771 — Critical (CVSS 9.9): Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus:…
- CVE-2024-39931 — Critical (CVSS 9.9): Gogs through 0.13.0 allows deletion of internal files.
- CVE-2021-43821 — Critical (CVSS 9.9): Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6…
Browse all CWE-552 (Files or Directories Accessible to External Parties) vulnerabilities →