Cyber Resilience

CVE-2025-36640

HighLPE

Published: 13 January 2026

Published
13 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v4 7.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0011 1.5th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-36640 is a high-severity Improper Privilege Management (CWE-269) vulnerability. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-36640 is a privilege escalation vulnerability (CWE-269) affecting the installation and uninstallation processes of the Nessus Agent Tray App on Windows hosts. Published on 2026-01-13, it has a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for significant impact when exploited locally.

A local attacker with low privileges (PR:L) can exploit this vulnerability through the Nessus Agent Tray App's installation or uninstallation mechanisms. The attack requires low complexity (AC:L) and no user interaction (UI:N), enabling privilege escalation with a changed scope (S:C) that results in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).

Tenable has published security advisory TNS-2026-01 at https://www.tenable.com/security/tns-2026-01, which details the vulnerability and associated mitigation guidance.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability details

A vulnerability has been identified in the installation/uninstallation of the Nessus Agent Tray App on Windows Hosts which could lead to escalation of privileges.

CWE(s)
CWE-269

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Direct local privilege escalation via exploitation of improper privilege management in install/uninstall processes.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-23896Shared CWE-269
CVE-2025-27639Shared CWE-269
CVE-2025-8899Shared CWE-269
CVE-2025-26705Shared CWE-269
CVE-2015-10139Shared CWE-269
CVE-2026-8972Shared CWE-269
CVE-2025-0893Shared CWE-269
CVE-2026-6769Shared CWE-269
CVE-2025-2858Shared CWE-269
CVE-2025-48613Shared CWE-269

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of the privilege escalation flaw in the Nessus Agent Tray App installation and uninstallation processes.

CM-11 User-installed Software good match
prevent

Prohibits low-privilege users from installing or uninstalling the vulnerable Nessus Agent Tray App, blocking the local exploitation vector.

AC-6 Least Privilege partial match
prevent

Enforces least privilege on accounts and processes to limit the scope and impact of privilege escalation during installation or uninstallation.

References