CVE-2025-36632: Tenable Nessus Agent Privilege Escalation

CVE-2025-36632 Overview

CVE-2025-36632 is a local privilege escalation vulnerability affecting Tenable Nessus Agent versions prior to 10.8.5 on Windows systems. This security flaw allows a non-administrative user to execute arbitrary code with SYSTEM privileges, representing a significant security risk for organizations running vulnerable versions of the agent.

The vulnerability stems from improper permission settings (CWE-276: Incorrect Default Permissions), which enables low-privileged local users to escalate their privileges to the highest level on Windows systems. This type of vulnerability is particularly concerning in enterprise environments where the Tenable Agent is deployed across numerous endpoints for vulnerability scanning and compliance monitoring.

Critical Impact

Non-administrative users can achieve SYSTEM-level code execution on Windows hosts running vulnerable Tenable Nessus Agent versions, potentially leading to complete system compromise.

Affected Products

• Tenable Nessus Agent versions prior to 10.8.5
• Microsoft Windows (all supported versions running vulnerable agent)

Discovery Timeline

• 2025-06-16 - CVE-2025-36632 published to NVD
• 2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-36632

Vulnerability Analysis

This privilege escalation vulnerability exists due to incorrect default permissions configured within the Tenable Nessus Agent installation on Windows hosts. The flaw allows authenticated local users with standard (non-administrative) privileges to execute code in the context of the SYSTEM account, which is the highest privilege level on Windows systems.

The local attack vector requires an attacker to have existing access to the target system, but no user interaction is required to exploit the vulnerability. Once exploited, the attacker gains complete control over the affected Windows host, with the ability to read, modify, or delete any data, install persistent backdoors, and move laterally within the network.

Root Cause

The root cause of CVE-2025-36632 is classified as CWE-276 (Incorrect Default Permissions). The Tenable Nessus Agent installation on Windows does not properly restrict access to certain resources, directories, or service configurations. This misconfiguration creates a pathway for non-privileged users to inject or manipulate code that will be executed with elevated SYSTEM privileges by the Tenable Agent service.

Attack Vector

The attack vector for this vulnerability is local, meaning an attacker must have authenticated access to the target Windows system. The exploitation scenario typically involves:

1. An attacker gains initial access to a Windows system as a standard, non-administrative user
2. The attacker identifies that Tenable Nessus Agent (version prior to 10.8.5) is installed
3. The attacker exploits the incorrect permissions to place malicious code or modify existing agent components
4. The Tenable Agent service, running as SYSTEM, executes the attacker's code
5. The attacker achieves SYSTEM-level privileges on the compromised host

The vulnerability mechanism involves exploiting misconfigured permissions in the Tenable Nessus Agent installation. On Windows systems, the agent service runs with SYSTEM privileges to perform comprehensive vulnerability assessments. Due to incorrect default permissions on certain agent components or directories, a local user can manipulate these elements to achieve code execution in the SYSTEM context. For detailed technical information, refer to Tenable Security Advisory TNS-2025-11.

Detection Methods for CVE-2025-36632

Indicators of Compromise

• Unusual process execution chains originating from Tenable Agent service processes
• Unexpected child processes spawned by nessuscli.exe or related agent executables
• Modifications to files or directories within the Tenable Agent installation path by non-administrative users
• Anomalous privilege escalation events in Windows Security logs correlating with Tenable Agent activity

Detection Strategies

• Monitor Windows Security Event Logs for Event ID 4688 (Process Creation) showing suspicious processes with SYSTEM privileges originating from Tenable Agent directories
• Implement file integrity monitoring on Tenable Agent installation directories to detect unauthorized modifications
• Review access control lists (ACLs) on Tenable Agent components to identify overly permissive configurations
• Deploy endpoint detection solutions to identify privilege escalation patterns associated with local exploitation attempts

Monitoring Recommendations

• Enable enhanced process auditing on systems running Tenable Nessus Agent to capture detailed execution telemetry
• Configure SIEM rules to alert on privilege escalation attempts involving security tool processes
• Establish baseline behavior for Tenable Agent processes and alert on deviations indicating potential abuse

How to Mitigate CVE-2025-36632

Immediate Actions Required

• Upgrade Tenable Nessus Agent to version 10.8.5 or later on all Windows hosts immediately
• Audit all Windows systems to identify installations of vulnerable Tenable Agent versions
• Restrict local user access on systems where immediate patching is not possible
• Review and harden file system permissions on Tenable Agent installation directories as an interim measure

Patch Information

Tenable has addressed this vulnerability in Tenable Nessus Agent version 10.8.5. Organizations should upgrade all affected Windows hosts to this version or later to remediate the vulnerability. The official security advisory with patch details is available from Tenable Security Advisory TNS-2025-11.

Workarounds

• Limit local user access to systems running the Tenable Agent until patching can be completed
• Implement application control policies to restrict execution of unauthorized binaries within the Tenable Agent directory structure
• Monitor vulnerable systems with enhanced logging and alerting until the patch is deployed
• Consider temporarily disabling the Tenable Agent service on high-value systems if the security risk outweighs the monitoring benefits

# Verify Tenable Agent version on Windows
"C:\Program Files\Tenable\Nessus Agent\nessuscli.exe" --version

# Stop the Tenable Agent service (temporary workaround if patching is delayed)
net stop "Tenable Nessus Agent"

# Audit permissions on Tenable Agent directory
icacls "C:\Program Files\Tenable\Nessus Agent" /T