CVE-2025-36633: Tenable Nessus Agent Privilege Escalation

CVE-2025-36633 Overview

A local privilege escalation vulnerability exists in Tenable Agent versions prior to 10.8.5 on Windows systems. This security flaw allows non-administrative users to arbitrarily delete local system files with SYSTEM privileges, which can be leveraged to achieve local privilege escalation on affected hosts.

Critical Impact

Non-privileged local users can delete arbitrary system files with SYSTEM-level permissions, potentially compromising system integrity and enabling full local privilege escalation on Windows endpoints.

Affected Products

• Tenable Nessus Agent versions prior to 10.8.5
• Microsoft Windows (all supported versions running vulnerable Tenable Agent)

Discovery Timeline

• June 13, 2025 - CVE-2025-36633 published to NVD
• October 23, 2025 - Last updated in NVD database

Technical Details for CVE-2025-36633

Vulnerability Analysis

This vulnerability falls under CWE-269 (Improper Privilege Management), indicating a fundamental flaw in how the Tenable Agent manages privileges during file system operations. The vulnerability enables a non-administrative user on a Windows host to leverage the Tenable Agent's elevated SYSTEM-level privileges to delete arbitrary files on the local system.

The attack requires local access to the vulnerable system, meaning an attacker must have an existing foothold on the target machine—either through physical access, remote desktop, or another compromise vector. Once local access is achieved, the attacker can exploit the improper privilege handling to delete critical system files or security configurations.

Root Cause

The root cause of CVE-2025-36633 lies in improper privilege management within the Tenable Agent software. The agent, which runs with SYSTEM-level privileges to perform vulnerability scanning operations, does not properly validate or restrict file deletion operations initiated by lower-privileged users. This allows non-administrative users to abuse the agent's elevated context to perform privileged file system operations.

Attack Vector

The attack vector is local, requiring the attacker to have existing access to the Windows system where the vulnerable Tenable Agent is installed. The exploitation flow typically involves:

1. An attacker gains low-privileged local access to a Windows endpoint running Tenable Agent prior to version 10.8.5
2. The attacker identifies the vulnerable file deletion functionality within the agent
3. By manipulating the agent's file handling mechanisms, the attacker triggers arbitrary file deletion with SYSTEM privileges
4. Critical system files, security software components, or configuration files can be deleted
5. The resulting system instability or security gaps can be leveraged for full privilege escalation

The vulnerability mechanism involves the Tenable Agent's file handling operations that run under SYSTEM context. Due to improper access controls, user-supplied inputs can influence which files are deleted, allowing an unprivileged user to target protected system locations. For detailed technical information, refer to the Tenable Security Advisory.

Detection Methods for CVE-2025-36633

Indicators of Compromise

• Unexpected deletion of system files or security software components on Windows endpoints
• Tenable Agent log entries showing file operations initiated by non-administrative user contexts
• System stability issues or missing configuration files following Tenable Agent activity
• Audit log entries indicating privilege escalation attempts following file deletion events

Detection Strategies

• Monitor Windows Security Event Logs for file deletion events (Event ID 4663) involving system-protected directories that correlate with Tenable Agent process activity
• Implement file integrity monitoring (FIM) on critical Windows system directories to detect unauthorized deletions
• Configure endpoint detection rules to alert on Tenable Agent (nessusagent.exe) performing unusual file operations outside its normal scanning scope
• Review Tenable Agent version inventory to identify endpoints running versions prior to 10.8.5

Monitoring Recommendations

• Enable advanced auditing on Windows file system access for critical directories including C:\Windows\System32 and security software directories
• Deploy SentinelOne Singularity to detect suspicious privilege escalation patterns and unauthorized file system modifications
• Establish baseline behavior for Tenable Agent file operations to identify anomalous deletion activity
• Monitor for processes spawned by or related to Tenable Agent that attempt to access or modify system-critical files

How to Mitigate CVE-2025-36633

Immediate Actions Required

• Upgrade all Tenable Agent installations to version 10.8.5 or later immediately
• Conduct an inventory audit to identify all Windows systems running vulnerable Tenable Agent versions
• Implement additional access controls to limit local access to systems where immediate patching is not feasible
• Enable enhanced monitoring on endpoints pending upgrade to detect potential exploitation attempts

Patch Information

Tenable has addressed this vulnerability in Tenable Agent version 10.8.5. Organizations should upgrade to this version or later to remediate CVE-2025-36633. The security advisory and patch details are available from the Tenable Security Advisory (TNS-2025-11).

Workarounds

• Restrict local user access to systems running vulnerable Tenable Agent versions until patching can be completed
• Implement application whitelisting to control which processes can perform file operations in system-critical directories
• Enable Windows File System auditing to create an audit trail of all file deletion events for forensic purposes
• Consider temporarily disabling or uninstalling vulnerable Tenable Agent installations on high-value assets if immediate patching is not possible

# Verify Tenable Agent version on Windows
# Run from elevated command prompt
"C:\Program Files\Tenable\Nessus Agent\nessuscli.exe" agent status

# Check if version is below 10.8.5 and schedule upgrade accordingly
# Upgrade via Tenable management console or manually download from Tenable portal