Windows CVE-2025-36632

This vulnerability presents substantial real-world risk across multiple dimensions: (1) CVSS 7.8 (High) reflects the severity accurately—local code execution as SYSTEM is a critical privilege escalation. (2) The attack vector (Local, AC:Low, PR:Low) means any standard Windows user can exploit this; no authentication bypass or social engineering needed. (3) The lack of User Interaction (UI:N) requirement eliminates a barrier to automation. (4) Confidentiality, Integrity, and Availability impacts are all HIGH (C:H/I:H/A:H), meaning full system compromise is possible. (5) CWE-276 (Incorrect Default Permissions) is historically prevalent and often trivial to exploit once discovered. Without public EPSS or KEV data provided, we assess exploitation probability as HIGH given the simplicity (AC:L, straightforward privilege escalation pattern). The vulnerability is likely automatable, increasing risk in botnet/malware scenarios. Organizations running Tenable Agent in environments with hostile or untrusted local users face immediate risk. This is not a 'high-CVSS-but-low-risk' issue; it is a genuine, priority-one security defect that enables lateral movement, persistence, and complete endpoint compromise.

Attack Scenario: A contractor or temporary employee with a standard unprivileged Windows account logs into a workstation running Tenable Agent 10.8.4. The attacker exploits the CWE-276 flaw (likely an insecure file permission, named pipe, or service endpoint accessible to standard users) to escalate privileges to SYSTEM without authentication or user interaction. Once SYSTEM-level code execution is achieved, the attacker can: (a) disable Windows Defender or EDR; (b) install persistent malware or backdoors; (c) harvest credentials from memory or credential stores; (d) exfiltrate sensitive data; (e) move laterally to other systems on the network using stolen credentials or trust relationships. The low complexity (AC:L) and lack of required user interaction (UI:N) mean the exploit is a simple, automated payload—likely a few lines of code or a publicly available POC. In a botnet/ransomware scenario, malware already resident on a system could use this LPE to break out of sandboxing or limited-privilege execution contexts and gain full system control. The vulnerability is particularly dangerous in shared workstation environments (call centers, labs, shared development machines) where multiple users have local access.