CVE-2025-36631 Overview
CVE-2025-36631 is a local privilege escalation vulnerability in Tenable Nessus Agent versions prior to 10.8.5 on Windows hosts. A non-administrative user can leverage the agent's logging behavior to overwrite arbitrary files on the local system with log content at SYSTEM privilege. The flaw maps to [CWE-269: Improper Privilege Management] and stems from the agent writing log data to attacker-influenced file paths while running under a privileged service context. Exploitation requires local access with low privileges and no user interaction.
Critical Impact
A low-privileged local user can overwrite protected Windows system files with attacker-controllable log content, enabling privilege escalation to SYSTEM and full host compromise.
Affected Products
- Tenable Nessus Agent versions prior to 10.8.5
- Microsoft Windows hosts running the affected agent
- Deployments where the Nessus Agent service runs under SYSTEM
Discovery Timeline
- 2025-06-13 - CVE-2025-36631 published to NVD
- 2026-06-17 - Last updated in NVD database
- Vendor Advisory - Tenable Security Advisory TNS-2025-11
Technical Details for CVE-2025-36631
Vulnerability Analysis
The Tenable Nessus Agent runs as a Windows service under the SYSTEM account so it can perform host inventory and vulnerability scanning tasks. The agent writes diagnostic and operational data to log files during execution. In versions prior to 10.8.5, a local non-administrative user can influence the log file destination path in a way that causes the privileged service to write log content to arbitrary locations on the file system. Because the write occurs under SYSTEM, standard NTFS access controls do not prevent overwriting protected files, including binaries, configuration files, and DLLs used by other privileged services.
Root Cause
The root cause is improper privilege management [CWE-269]. The agent does not sufficiently validate or constrain the target path when generating log output, and it does not impersonate the calling user before performing the write. Combined with the SYSTEM service context, this allows an unprivileged process to trigger writes to locations it could not otherwise modify. Symbolic link or junction abuse against agent-writable directories is a typical primitive for this class of flaw on Windows.
Attack Vector
A local authenticated user with low privileges stages a redirection primitive, such as a file system junction, hard link, or object-manager symbolic link, that maps an agent-controlled log path to a sensitive target file. The user then triggers agent behavior that produces log output. The service follows the redirection and overwrites the target file with attacker-influenced log content. By choosing a target such as a service DLL or a scheduled task binary, the attacker converts arbitrary file write into arbitrary code execution as SYSTEM.
No verified public proof-of-concept code is available. Technical details are described in the Tenable Security Advisory TNS-2025-11.
Detection Methods for CVE-2025-36631
Indicators of Compromise
- Unexpected modification timestamps on files under C:\Windows\System32\ or other privileged directories that coincide with nessus-service.exe or nessusd.exe activity.
- Presence of NTFS reparse points, junctions, or hard links inside directories writable by the Nessus Agent, particularly under C:\ProgramData\Tenable\Nessus Agent\.
- Log files containing content that appears in unrelated system binaries or configuration files.
Detection Strategies
- Monitor process creation and file write events where the parent process is the Nessus Agent service and the target path resolves outside the expected log directory.
- Alert on creation of junctions or symbolic links by non-administrative users inside the Nessus Agent working directories.
- Correlate SYSTEM-context file writes to protected paths with recent activity from low-privileged user sessions.
Monitoring Recommendations
- Enable Windows Sysmon Event IDs 11 (FileCreate), 15 (FileCreateStreamHash), and 2 (FileCreateTime) on hosts running the Nessus Agent.
- Track integrity of critical system binaries and service DLLs with file integrity monitoring and forward events to a centralized data lake for correlation.
- Behavioral endpoint tooling such as SentinelOne Singularity Endpoint can flag SYSTEM-privileged writes that follow user-controlled reparse points, a pattern common to this class of privilege escalation.
How to Mitigate CVE-2025-36631
Immediate Actions Required
- Upgrade all Windows Tenable Nessus Agent installations to version 10.8.5 or later.
- Inventory endpoints running the agent and prioritize multi-user hosts, jump boxes, and terminal servers where local users are present.
- Audit the Nessus Agent working directories for existing junctions, symbolic links, or unexpected file ownership before patching.
Patch Information
Tenable has released Nessus Agent 10.8.5 for Windows, which addresses the improper privilege management issue. Refer to Tenable Security Advisory TNS-2025-11 for release artifacts and version guidance.
Workarounds
- Restrict interactive logon on hosts running the agent to trusted administrative users until patching completes.
- Apply strict NTFS permissions on the Nessus Agent log and working directories to prevent link creation by standard users.
- Enable Windows symbolic link creation restrictions via Group Policy so non-administrative users cannot create the primitives required for exploitation.
# Verify installed Nessus Agent version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Tenable\Nessus Agent" |
Select-Object -Property "Product Version", "Install Path"
# Restrict symlink creation to administrators via secpol
# User Rights Assignment -> "Create symbolic links"
# Remove: Authenticated Users
# Keep: Administrators
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
