CVE-2025-36640: Nessus Agent Privilege Escalation Flaw

CVE-2025-36640 Overview

CVE-2025-36640 is a local privilege escalation vulnerability in the Nessus Agent Tray App on Windows hosts. The flaw resides in the installation and uninstallation routines of the tray application. An authenticated local attacker with low privileges can leverage improper privilege management [CWE-269] to gain elevated rights on the host.

Tenable disclosed the issue in security advisory TNS-2026-01. The vulnerability requires local access and some attack prerequisites, but successful exploitation impacts confidentiality, integrity, and availability of both the vulnerable component and the surrounding system.

Critical Impact
A local, low-privileged Windows user can escalate to elevated privileges by abusing the Nessus Agent Tray App install or uninstall workflow, gaining full control of affected endpoints.

Affected Products

Nessus Agent Tray App on Windows hosts (see Tenable advisory TNS-2026-01 for specific versions)
Windows endpoints running the Nessus Agent with the Tray App component installed
Environments performing install or uninstall operations of the Nessus Agent Tray App

Discovery Timeline

2026-01-13 - CVE-2025-36640 published to NVD by Tenable
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36640

Vulnerability Analysis

The vulnerability affects the install and uninstall workflows of the Nessus Agent Tray App on Windows. During these workflows, the application performs privileged operations that are not properly restricted from lower-privileged users. This mismatch enables improper privilege management, classified under [CWE-269].

An attacker with a standard user account on the Windows host can influence these operations to execute code or modify resources in a security context they should not have access to. The result is escalation from a low-privileged local account to a higher-privileged context on the endpoint.

Because the flaw is scoped to a local user with existing access, remote exploitation is not possible. However, on multi-user systems and endpoints exposed to phishing-driven initial access, this vulnerability provides a reliable post-compromise privilege step.

Root Cause

The root cause is improper privilege management [CWE-269] in the install and uninstall paths of the Nessus Agent Tray App. Privileged operations executed by the installer or uninstaller are not adequately isolated from user-controllable inputs or resources, allowing a low-privileged user to influence execution under a higher-privileged context.

Attack Vector

Exploitation requires local access to the Windows host and low-level authenticated privileges. The attacker triggers or interacts with the install or uninstall flow of the Nessus Agent Tray App to abuse the privileged operations it performs. Specific exploitation details are not published in the Tenable advisory, and no public proof-of-concept is currently available.

Refer to the Tenable Security Advisory TNS-2026-01 for authoritative technical details.

Detection Methods for CVE-2025-36640

Indicators of Compromise

Unexpected install or uninstall activity for the Nessus Agent Tray App outside of scheduled maintenance windows
Child processes spawned by the Nessus Agent Tray App installer or uninstaller running as SYSTEM or another elevated context
Creation or modification of files or registry keys in privileged locations during Nessus Agent Tray App install or uninstall events

Detection Strategies

Monitor Windows MSI and installer logs for Nessus Agent Tray App events initiated by non-administrative users
Baseline expected patch and deployment windows for the Nessus Agent, and alert on install or uninstall activity that falls outside those windows
Correlate process lineage where the tray application installer spawns shells, script interpreters, or unsigned binaries under elevated tokens

Monitoring Recommendations

Enable Windows Sysmon process creation, file, and registry auditing on hosts running the Nessus Agent
Forward endpoint telemetry to a centralized SIEM or data lake for correlation across installation events and subsequent privileged activity
Track token elevation and integrity level transitions associated with Nessus Agent Tray App processes

How to Mitigate CVE-2025-36640

Immediate Actions Required

Apply the fixed version of the Nessus Agent as listed in Tenable Security Advisory TNS-2026-01
Restrict local user permissions on Windows hosts running the Nessus Agent Tray App to limit who can trigger install or uninstall operations
Audit endpoints for unauthorized changes made during install or uninstall workflows since the vulnerability was disclosed

Patch Information

Tenable has published guidance and fixed releases in advisory TNS-2026-01. Administrators should upgrade the Nessus Agent to the version identified in the advisory. Reference: Tenable Security Advisory TNS-2026-01.

Workarounds

Limit install and uninstall operations for the Nessus Agent Tray App to administrator-controlled deployment tooling
Remove the Nessus Agent Tray App component on hosts where it is not required, retaining only the core agent service
Enforce application control policies that restrict which users can execute the Nessus Agent installer or uninstaller binaries

bash

# Example: query installed Nessus Agent version on a Windows host (PowerShell)
Get-WmiObject -Class Win32_Product |
  Where-Object { $_.Name -like "*Nessus Agent*" } |
  Select-Object Name, Version, Vendor