CVE-2026-78587CWE-863broken-access-control

CVE-2026-78587

Low · published September 2, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
21.0
In the wild
Unconfirmed
What it is

Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00295 · 21.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-02T19:17Z
Affected products (3)
ProductVersionsFixed in
elastic/fleet_server≥ 8.0.0, < 8.19.168.19.16
elastic/fleet_server≥ 9.0.0, < 9.3.59.3.5
elastic/fleet_server≥ 9.4.0, < 9.4.29.4.2
References (1)
https://discuss.elastic.co/t/fleet-server-8-19-16-9-3-5-9-4-2-security-update-esa-2026-164/390117 · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 02 SEP 14:43Z
    Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations
    cvelistv5