CVE-2026-78604CWE-732

CVE-2026-78604

High · published September 2, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
3.8
In the wild
Unconfirmed
What it is

Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls broader than required. A local user could take advantage of this to cause the service to execute code of their choosing, ultimately obtaining SYSTEM-level privileges on the host.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00149 · 3.8th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-09-02T19:17Z
Affected products (3)
ProductVersionsFixed in
elastic/elastic_agent≥ 8.0.0, < 8.19.218.19.21
elastic/elastic_agent≥ 9.0.0, < 9.4.69.4.6
elastic/elastic_agent≥ 9.5.0, < 9.5.29.5.2
References (1)
https://discuss.elastic.co/t/elastic-agent-8-19-21-9-4-6-9-5-2-security-update-esa-2026-150/390109 · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 02 SEP 14:43Z
    Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM
    cvelistv5