CVE-2025-36630 Overview
CVE-2025-36630 is a local privilege escalation vulnerability in Tenable Nessus on Windows hosts. A non-administrative user can overwrite arbitrary local system files with log content while the Nessus service runs at SYSTEM privilege. The flaw affects Tenable Nessus versions prior to 10.8.5 running on Microsoft Windows. Tenable published advisory TNS-2025-13 documenting the issue and providing a fixed release. The vulnerability is tracked under CWE-269: Improper Privilege Management.
Critical Impact
A low-privileged local user can corrupt or overwrite protected system files, enabling denial of service and potential privilege escalation to SYSTEM.
Affected Products
- Tenable Nessus versions prior to 10.8.5
- Microsoft Windows host installations of Nessus
- Nessus scanner and Nessus Professional deployments on Windows
Discovery Timeline
- 2025-07-02 - CVE-2025-36630 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36630
Vulnerability Analysis
The Nessus service on Windows runs under the SYSTEM account and writes log files to disk during scanner operation. The service does not adequately validate log file paths or the permissions of destination directories before writing. A local, non-administrative user can influence the log write target so that the SYSTEM-privileged process writes attacker-controlled log content over arbitrary files on the host. This turns log output into a primitive for overwriting protected files that the low-privileged user cannot normally modify. The result is a local privilege management failure with integrity and availability impact on the underlying operating system.
Root Cause
The root cause is improper privilege management [CWE-269] combined with insufficient validation of file write targets by a service running at SYSTEM. The Nessus process trusts path or link constructs that a local user controls, allowing redirection of log writes outside of the intended log directory.
Attack Vector
Exploitation requires local access and low privileges on the Windows host. No user interaction is needed. An attacker with an interactive or service account on the machine can manipulate file system objects, such as junctions or symbolic links in user-writable paths referenced by Nessus, to redirect log output onto sensitive files. Overwriting binaries, configuration files, or scheduled task definitions can lead to denial of service or code execution at SYSTEM. Refer to the Tenable Security Advisory TNS-2025-13 for vendor technical details.
Detection Methods for CVE-2025-36630
Indicators of Compromise
- Unexpected modifications to files outside the Nessus installation and log directories with timestamps matching Nessus service activity.
- Presence of NTFS junction points or symbolic links in user-writable directories that point into %ProgramFiles%\Tenable\Nessus\ or system paths.
- Nessus log entries containing content that also appears within system binaries, configuration files, or scripts.
Detection Strategies
- Monitor file write events by nessusd.exe and nessus-service.exe targeting paths outside the expected Nessus data directory.
- Alert on creation of reparse points or symlinks by non-administrative users in directories accessed by the Nessus service.
- Track integrity of critical Windows system files and Nessus-adjacent binaries using file integrity monitoring.
Monitoring Recommendations
- Enable Windows Security auditing for object access on system directories and Nessus program files.
- Forward Sysmon EventID 11 (FileCreate) and EventID 15 (FileCreateStreamHash) for the Nessus process tree to a central SIEM.
- Review Nessus scanner installations for version strings below 10.8.5 across the fleet.
How to Mitigate CVE-2025-36630
Immediate Actions Required
- Upgrade all Windows Nessus installations to version 10.8.5 or later.
- Inventory Windows hosts running Nessus and confirm the running version through nessuscli --version.
- Restrict interactive and remote logon on Nessus scanner hosts to administrative users only.
- Audit the Nessus log and data directories for unexpected reparse points or symbolic links.
Patch Information
Tenable addressed the flaw in Nessus 10.8.5. Download the fixed release from Tenable and follow the upgrade guidance in the Tenable Security Advisory TNS-2025-13. Windows hosts should be rebooted after upgrade to ensure the updated service binary is loaded.
Workarounds
- Limit shell and RDP access to Nessus scanner hosts so only trusted administrators can log on locally.
- Remove any unnecessary local accounts and revoke SeCreateSymbolicLinkPrivilege from standard users via Group Policy.
- Apply strict ACLs on parent directories used by Nessus logging to prevent creation of junctions by low-privileged users.
# Verify installed Nessus version on Windows
"C:\Program Files\Tenable\Nessus\nessuscli.exe" --version
# Group Policy path to remove symlink creation right from standard users:
# Computer Configuration > Windows Settings > Security Settings >
# Local Policies > User Rights Assignment > "Create symbolic links"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
