What is the CVSS score of CVE-2025-36632?

CVE-2025-36632 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2025-36632?

Tenable Agent for Windows versions prior to 10.8.5 contains a local privilege escalation vulnerability (CVSS 7.8) allowing standard users to execute arbitrary code with SYSTEM privileges, posing a…. A patch is available.

How to fix or mitigate CVE-2025-36632?

Within 24 hours: Identify all Windows systems running Tenable Agent versions prior to 10.8.5 using your asset management and patch management tools; communicate patch timeline to system owners. Within 7 days: Deploy Tenable Agent version 10.8.5 or later to all affected Windows systems using your patch management solution (WSUS, Intune, third-party patch tools, or manual distribution); prioritize multi-user systems and shared administrative workstations. Within 30 days: Verify 100% patching completion through vulnerability scanning or Tenable Nessus scans; document remediation in change management and audit logs.

Windows CVE-2025-36632

EUVD-2025-18396 HIGH

Incorrect Default Permissions (CWE-276)

2025-06-16 vulnreport@tenable.com

Windows Information Disclosure Microsoft Nessus Agent Tenable

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:38 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

10.8.5

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18396

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

CVE Published

Jun 16, 2025 - 14:15 nvd

HIGH 7.8

DescriptionCVE.org

In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege.

AnalysisAI

Privilege escalation vulnerability in Tenable Agent for Windows (versions prior to 10.8.5) that allows a non-administrative local user to execute arbitrary code with SYSTEM-level privileges. This is a local privilege escalation (LPE) vulnerability with high severity (CVSS 7.8) requiring only local access and low complexity exploitation. The vulnerability represents a critical risk in multi-user Windows environments where standard users could gain complete system control.

Technical ContextAI

The vulnerability exists in Tenable Agent, a endpoint detection and response (EDR) / vulnerability assessment agent deployed on Windows systems. The root cause is classified under CWE-276 (Incorrect Default Permissions), indicating improper access controls on a critical system resource or service. Tenable Agent typically runs with elevated privileges to perform system-level vulnerability scanning and monitoring. The vulnerability allows privilege escalation from a standard user context to SYSTEM, suggesting either: (1) an insecure service running as SYSTEM that can be exploited by unprivileged users, (2) improper file/registry permissions on agent components, or (3) insecure inter-process communication (IPC) mechanisms. The Local Attack Vector (AV:L) and Low Attack Complexity (AC:L) indicate the flaw is likely trivial to exploit once a user has local access—no special conditions or sophisticated techniques required. The vulnerability affects Windows deployments specifically, as the advisory explicitly mentions 'Windows host.'

RemediationAI

Immediate actions: (1) Upgrade Tenable Agent to version 10.8.5 or later on all Windows systems. Tenable has provided a patched version; deployment should be prioritized. (2) For systems that cannot be immediately patched, implement compensating controls: restrict local user access to systems running vulnerable Tenable Agent; disable or suspend non-essential local user accounts; use OS-level privilege policies to limit local user capability. (3) Monitor for exploitation attempts: audit local code execution events, system-level process spawning, and unexpected SYSTEM-context processes originating from standard user sessions. (4) Review Tenable advisories and security bulletins for detailed patch notes and deployment instructions. (5) Test patches in a non-production environment before widespread rollout to ensure compatibility with monitoring requirements. Recommend mandatory upgrade timeline: critical systems within 7 days, all systems within 30 days.