CVE-2025-36631: 
Tenable Nessus Agent vulnerability analysis and mitigation

CVE-2025-36631 is a privilege escalation vulnerability in Tenable Agent (Nessus Agent) for Windows that allows a non-administrative local user to overwrite arbitrary system files with log content at SYSTEM privilege level. It affects all Tenable Agent versions prior to 10.8.5 on Windows hosts. The vulnerability was reported to Tenable on 2025-05-10, confirmed on 2025-05-28, and patched with the release of Nessus Agent 10.8.5 on 2025-06-12. It carries a CVSSv3 base score of 8.4 (High) per Tenable's advisory (Tenable Advisory).

The root cause is classified as CWE-269 (Improper Privilege Management), where the Tenable Agent service — running at SYSTEM privilege — does not adequately restrict which files can be targeted for log output by a low-privileged user (Tenable Advisory). An attacker with a local, low-privileged account can manipulate the agent's logging mechanism to redirect log content to arbitrary system files, effectively overwriting them with attacker-influenced data while the write operation executes under SYSTEM context. No user interaction is required, and the attack complexity is low. The vulnerability was discovered and reported by researcher Rishad Sheikh (Tenable Advisory).

Successful exploitation allows a low-privileged local user to overwrite arbitrary Windows system files with log content at SYSTEM privilege, compromising system integrity and potentially availability. An attacker could corrupt or replace critical OS or application files, leading to system instability, denial of service, or a pathway for further privilege escalation to full SYSTEM-level control. Confidentiality impact is limited since the primitive is a write (not read), but the ability to overwrite system files could facilitate secondary attacks such as planting malicious binaries or disabling security controls (Tenable Advisory).

There is no public proof-of-concept exploit available and no evidence of in-the-wild exploitation as of the time of disclosure (Tenable Advisory). The vulnerability requires local access with a low-privileged account, limiting remote exploitation. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Gain local access: Obtain a low-privileged (non-administrative) user account on a Windows host running Tenable Agent version 10.8.5 or earlier.
2. Identify the agent's logging configuration: Locate the Tenable Agent installation directory (typically C:\Program Files\Tenable\Nessus Agent\) and identify any user-accessible configuration or log path settings that influence where the SYSTEM-privileged service writes log data.
3. Redirect log output: Manipulate accessible configuration parameters or symlink/junction points to redirect the agent's log file path to a target arbitrary system file (e.g., a critical Windows system binary or configuration file).
4. Trigger log write: Cause the Tenable Agent service to generate log output (e.g., by initiating a scan, restarting the service, or triggering an event), which causes the SYSTEM-privileged process to overwrite the targeted file with log content.
5. Achieve objective: The overwritten system file can be used to corrupt system integrity, disable security tools, or plant a payload for further privilege escalation or persistence (Tenable Advisory).

• File System: Unexpected modification timestamps on Windows system files (e.g., in C:\Windows\System32\) coinciding with Tenable Agent log activity; log content appearing in non-standard file locations outside the Tenable Agent installation directory.
• Logs: Windows Security Event Log entries (Event ID 4663) showing write access to sensitive system files by the Tenable Agent service (nessus-agent.exe or similar) running as SYSTEM; unusual file write events originating from the Tenable Agent process to paths outside its installation directory.
• Process: Tenable Agent service process (nessus-agent.exe) performing file write operations to unexpected directories as observed via Sysmon Event ID 11 (FileCreate) or Process Monitor traces.
• Network: No specific network IOCs identified for this local privilege escalation vulnerability.

Tenable has released Nessus Agent version 10.8.5 to address CVE-2025-36631 along with two related vulnerabilities (CVE-2025-36632 and CVE-2025-36633). Organizations should upgrade all Windows-based Tenable Agent deployments to version 10.8.5 or later immediately, available from the Tenable Downloads Portal. Tenable also updated the Agent 10.8.5 release notes with additional mitigation information. As interim measures, restrict local user permissions on hosts running Tenable Agent, monitor system file modifications, and apply least-privilege principles to limit the impact of exploitation (Tenable Advisory).

SecurityWeek covered the vulnerability as part of a broader report on high-severity flaws patched in Tenable Nessus Agent, noting the significance of the three co-disclosed CVEs (SecurityWeek). CyberSecurityNews and IT Security News reported on the vulnerability with headlines highlighting the risk of attackers gaining admin-level access to delete system files (CyberSecurityNews). The Hacker News included the vulnerability in its weekly security recap, and the CVE appeared in Reddit's CVEWatch trending list for June 17, 2025, indicating moderate community interest. No significant controversy or researcher debate was noted beyond standard disclosure coverage.