What’s Vulnerable › Vulnerabilities
CVE-2026-78604: Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-02 · updated 2026-09-04
- Weakness: CWE-732
Description
Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls broader than required. A local user could take advantage of this to cause the service to execute code of their choosing, ultimately obtaining SYSTEM-level privileges on the host.
Affected products
- Elastic Agent: from 8.0.0 before 8.19.21; from 9.0.0 before 9.4.6; from 9.5.0 before 9.5.2 — fixed in 8.19.21, 9.4.6, 9.5.2
How to fix
Upgrade to a fixed version: Elastic Agent 8.19.21, 9.4.6, 9.5.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-78604 or the next vulnerability affects your stack