CVE-2025-36633: 
Tenable Nessus Agent vulnerability analysis and mitigation

CVE-2025-36633 is a local privilege escalation vulnerability in Tenable Agent (Nessus Agent) for Windows that allows a non-administrative user to arbitrarily delete local system files with SYSTEM-level privileges. It affects all Tenable Agent versions prior to 10.8.5 on Windows hosts. The vulnerability was reported to Tenable on 2025-06-03, confirmed on 2025-06-07, and patched with the release of Nessus Agent 10.8.5 on 2025-06-12. Tenable assigns it a CVSSv3 base score of 8.8 (High) with a temporal score of 7.9, credited to Julian Härig of TÜV Rheinland (Tenable Advisory).

The vulnerability is classified as CWE-269 (Improper Privilege Management), arising from the Tenable Agent service running with SYSTEM privileges on Windows while allowing low-privileged local users to influence file deletion operations performed by that service. This is a local attack vector (AV:L) requiring only low privileges (PR:L) and no user interaction, with a changed scope (S:C) indicating the impact extends beyond the vulnerable component itself. The flaw is part of a trio of related vulnerabilities in the same advisory (CVE-2025-36631 for arbitrary file overwrite with log content, CVE-2025-36632 for arbitrary code execution with SYSTEM privilege), all sharing the same root cause of insufficient privilege separation in the agent's Windows service (Tenable Advisory).

A local attacker with standard (non-administrative) user access on a Windows host running a vulnerable Tenable Agent can delete arbitrary system files with SYSTEM privileges, potentially destabilizing or crashing the operating system, disrupting security tooling, or leveraging the deletion to achieve full local privilege escalation. The changed scope in the CVSS vector indicates that impacts extend beyond the Tenable Agent process itself to the underlying Windows OS, affecting confidentiality, integrity, and availability at the HIGH level. This could be used as a stepping stone for further lateral movement or persistence on the compromised host (Tenable Advisory).

No public proof-of-concept exploit code has been identified for CVE-2025-36633 at this time, and there is no evidence of in-the-wild exploitation. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the target Windows system with at least a standard user account, limiting the attack surface compared to remote vulnerabilities (Tenable Advisory).

1. Gain local access: Obtain a low-privileged (non-administrative) user account on a Windows host running Tenable Agent version 10.8.4 or earlier.
2. Identify the vulnerable service: Confirm the Tenable Agent service is running with SYSTEM privileges (e.g., via sc qc "Tenable Agent" or Task Manager).
3. Trigger file deletion: Interact with the Tenable Agent's exposed local interface or file paths in a manner that causes the SYSTEM-privileged service to delete an attacker-specified file — leveraging the improper privilege management flaw (CWE-269) that fails to restrict which files the service will delete on behalf of a low-privileged user.
4. Target critical system files: Direct the deletion at Windows system files (e.g., DLLs, drivers, or security tool components) to destabilize the OS, disable defenses, or create conditions for privilege escalation (e.g., DLL planting after deletion).
5. Escalate privileges: Exploit the resulting system state (e.g., missing security binary, disabled AV) to achieve SYSTEM-level code execution through a secondary technique (Tenable Advisory).

• Logs: Windows Security Event Log entries showing file deletion events (Event ID 4663) targeting system directories (e.g., C:\Windows\System32) initiated by the Tenable Agent service account (SYSTEM) but triggered by a non-administrative user session.
• Process: Unusual child processes or file operations spawned by the Tenable Agent service (nessus-agent.exe) that involve deletion of files outside the agent's expected working directories.
• File System: Missing or unexpectedly deleted system files or DLLs in Windows system directories; presence of replacement DLLs (DLL planting artifacts) in locations previously occupied by deleted files.
• Service: Tenable Agent service crashes or unexpected restarts following file deletion activity; Windows Event Log entries (Event ID 7034 or 7031) indicating service failures around the time of suspicious file operations (Tenable Advisory).

Tenable has released Nessus Agent version 10.8.5 (released 2025-06-12) to address CVE-2025-36633 along with CVE-2025-36631 and CVE-2025-36632. Organizations should upgrade all Windows-based Tenable Agent deployments to version 10.8.5 or later immediately. Installation files are available from the Tenable Downloads Portal. Tenable also updated the Agent 10.8.5 release notes with additional mitigation information; administrators should review those notes for any configuration-based interim guidance. As a general precaution, restrict local user access on hosts running Tenable Agent and monitor for unauthorized file deletion activity (Tenable Advisory).

SecurityWeek covered the vulnerability as part of a broader report on high-severity flaws patched in Tenable Nessus Agent, noting the significance of the privilege escalation risk (SecurityWeek). CyberSecurityNews and ITSecurityNews highlighted the flaw with headlines emphasizing the ability for attackers to "login as admin to delete system files," drawing community attention on social media including Mastodon. The Hacker News included the vulnerability in its weekly security recap, broadening awareness. Overall community sentiment reflects moderate concern given the local-only attack vector, but the SYSTEM-level impact and the fact that Tenable's own security tooling is affected drew notable attention from security professionals.