The affected component writes sensitive data to log files, resulting in the accidental exposure of confidential information. This weakness, classified as a log file management issue, can lead to compromise of sensitive data confidentiality if logs are accessed by unauthorized users. The CVE report does not indicate that an attacker can trigger the inclusion directly, but the presence of sensitive data in logs poses a direct privacy risk.

The issue affects the Tanium Reputation product. Specific product versions are not disclosed in the advisory, so all deployed instances should be reviewed for the presence of the vulnerability until a patch is applied.

The CVSS score of 6.6 denotes a medium severity. Because the EPSS score is not provided and the vulnerability is not listed in CISA KEV, there is no evidence of widespread exploitation. Likely, the vulnerability can be triggered by normal operation of the Reputation service, meaning that any user with access to the logs could obtain sensitive data. Guidance from the vendor suggests applying the next available update to eliminate the risk.