Tenable recently released important security patches for the Nessus Agent, addressing several high-severity vulnerabilities that could allow local users to escalate privileges, overwrite or delete files, or execute arbitrary code with elevated privileges. The most recent fixes are included in Nessus Agent version 10.8.5, released in June 2025.
Nessus Agent is a lightweight endpoint security application developed by Tenable that extends vulnerability scanning to assets that are difficult or impossible to reach with traditional network-based scans. It is designed to provide comprehensive visibility and coverage across endpoints, remote assets, and transient devices—such as laptops, virtual machines, or systems that are not always connected to the network.
Nessus Agents are installed on target systems (Windows, macOS, Linux). Once installed and registered with a Tenable management platform, they perform scheduled or on-demand scans locally. Results are transmitted back to the manager for centralized analysis and reporting.
Key Vulnerabilities Fixed
The following vulnerabilities were addressed in Nessus Agent version 10.8.5:
| CVE ID | Severity (CVSS v3.1) | Description |
|---|---|---|
| CVE-2025-36631 | 8.4 (High) | Allows non-administrative users to overwrite arbitrary local system files with log content as SYSTEM. |
| CVE-2025-36632 | 7.8 (High) | Allows non-administrative users to execute arbitrary code with SYSTEM privileges. |
| CVE-2025-36633 | 8.8 (High) | Allows non-administrative users to arbitrarily delete local system files with SYSTEM privileges. |
Successful exploitation of these vulnerabilities could result in local privilege escalation on affected Windows systems running Nessus Agent versions 10.8.4 and earlier.
Additional Security Improvements
Other recent updates addressed issues such as:
• Fixing improper privilege management and symlink handling that could be abused by local users.
• Updating third-party libraries (e.g., libxml2, expat) to patch potential vulnerabilities.
• Ensuring proper ACLs are set during custom installations on Windows.
