CVE-2025-36630: 
Tenable Nessus vulnerability analysis and mitigation

CVE-2025-36630 is a local privilege escalation vulnerability in Tenable Nessus on Windows that allows a non-administrative user to overwrite arbitrary local system files with log content at SYSTEM privilege level. It affects all Nessus versions prior to 10.8.5 running on Windows hosts. The vulnerability was reported to Tenable on 2025-05-10, confirmed on 2025-05-28, and patched with the release of Nessus 10.8.5 and 10.9.0 on 2025-06-30. Tenable assigns it a CVSSv3 Base Score of 8.4 (High) with a temporal score of 7.6, while NVD scores it 7.1 (High) (Tenable Advisory).

The root cause is classified as CWE-269 (Improper Privilege Management), where the Nessus service — running at SYSTEM privilege on Windows — does not adequately restrict which files can be targeted when writing log content (Tenable Advisory). A low-privileged local user can manipulate the logging mechanism to redirect log output to arbitrary system file paths, effectively overwriting those files with attacker-influenced log content using SYSTEM-level write access. Exploitation requires only local access and low privileges, with no user interaction needed. The vulnerability was discovered and reported by researcher Rishad Sheikh (Tenable Advisory).

Successful exploitation allows a low-privileged local user to overwrite arbitrary Windows system files with log content, resulting in high integrity and high availability impacts. An attacker could corrupt or replace critical system files (e.g., executables, configuration files, or security policy files), potentially leading to system instability, denial of service, or a pathway to full system compromise. Confidentiality is not directly impacted, but the ability to overwrite system files could be chained with other techniques to achieve privilege escalation or persistent access (Tenable Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Tenable Advisory). The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the Windows host running Nessus, limiting the attack surface to users with existing system access.

1. Gain local access: Obtain a low-privileged (non-administrative) user account on a Windows host running Tenable Nessus prior to version 10.8.5.
2. Identify log configuration: Locate or manipulate Nessus logging configuration to determine how and where log files are written by the SYSTEM-privileged Nessus service.
3. Redirect log output: Craft or manipulate the log file path setting so that the Nessus service writes log content to a target arbitrary system file (e.g., a critical Windows executable, DLL, or configuration file).
4. Inject malicious content: Influence the content of log entries (e.g., by triggering specific Nessus actions or injecting data that appears in logs) so that the overwritten file contains attacker-controlled data.
5. Achieve impact: The targeted system file is overwritten at SYSTEM privilege, potentially corrupting it (denial of service), replacing it with a malicious payload (code execution on next invocation), or disabling security controls (Tenable Advisory).

• File System: Unexpected modification timestamps on critical Windows system files (e.g., files in C:\Windows\System32\) coinciding with Nessus service activity; system files containing log-formatted text content rather than expected binary or configuration data.
• Logs: Nessus log entries referencing unusual or non-standard file paths for log output; Windows Event Log entries (Event ID 4663) showing SYSTEM-level write access to sensitive files not normally written by Nessus.
• Process: Nessus service (nessusd.exe) performing file write operations to paths outside its normal installation and data directories, observable via process monitoring tools such as Sysmon (Event ID 11 - FileCreate).
• Registry/Configuration: Modifications to Nessus logging configuration files or registry keys that redirect log output to non-default paths.

Tenable has released Nessus versions 10.8.5 and 10.9.0 to address this vulnerability; upgrading to either version is the recommended remediation (Tenable Advisory). Installation files are available from the Tenable Downloads Portal. As interim mitigations, administrators should restrict local user access to Windows hosts running Nessus, audit and monitor system file integrity, and implement strict access controls on Nessus installation and configuration directories. No vendor-provided configuration-based workaround is documented as an alternative to patching.

The vulnerability received coverage from several cybersecurity news outlets including CyberSecurityNews, GBHackers, and CyberPress, which highlighted the risk of arbitrary system file overwrites on Windows Nessus installations (CyberSecurityNews, GBHackers). The Hacker News included it in a weekly recap of notable vulnerabilities (The Hacker News). Community discussion on Reddit's CVEWatch noted it among trending CVEs for the week of July 4, 2025. Overall sentiment reflects moderate concern given the local-only attack vector, with the security community emphasizing prompt patching for organizations running Nessus on Windows.