Lokaal Privilege Escalation

The impact of CVE-2025-36633 is severe due to the potential for local privilege escalation. An attacker who can exploit this vulnerability can gain SYSTEM-level access to the affected Windows host. This allows them to install malware, steal sensitive data, modify system configurations, and potentially pivot to other systems on the network. The ability to delete arbitrary system files means the attacker could disrupt critical services or render the system unusable. This vulnerability shares similarities with other privilege escalation flaws where unexpected file permissions are exploited to gain elevated access.

Organizations heavily reliant on Tenable Agent for vulnerability scanning and compliance are at significant risk. Environments with limited user access controls or those running older, unpatched Tenable Agent installations are particularly vulnerable. Shared hosting environments where users have limited but potentially exploitable file system access also face increased risk.

• windows / supply-chain:

Get-WinEvent -LogName Security -Filter "EventID = 4663 and SubjectUserName!=''" |
Where-Object {$_.Properties[6].Value -match "C:\\.*\\.dll"} |
Select-Object TimeCreated, SubjectUserName, ProcessName

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like "*malicious*"}

• windows / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like "*tenableagent*"}

1. 2025-06-13Disclosure

   disclosure

1. Gereserveerd2025-04-15
2. Gepubliceerd2025-06-13
3. Gewijzigd2026-02-26
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-36633 is to upgrade Tenable Agent to version 10.8.5 or later. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider implementing stricter file system permissions to limit the ability of non-administrative users to delete critical system files. While not a direct fix, this can reduce the potential impact of a successful exploit. Monitor system logs for unusual file deletion activity. After upgrading, confirm the fix by attempting to execute a file deletion command as a non-administrative user; the operation should be denied.