CVE-2026-78604 Elastic CVE debrief

Who should care

System administrators and security teams responsible for Elastic Agent installations, especially on Windows systems, should assess exposure and prioritize remediation. They should verify Elastic Agent versions and configurations to determine exposure and update to a safe version. Security teams should also monitor for suspicious activity on Windows systems with Elastic Agent installed and review compensating controls for exposed systems.

Why it matters

CVE-2026-78604 is a high-severity vulnerability in Elastic Agent that allows local privilege escalation on Windows systems. Defenders should verify Elastic Agent installations, especially on Windows, and update to a safe version. The vulnerability requires local access but can lead to significant impact if exploited.

• Local privilege escalation is possible, allowing attackers to gain SYSTEM-level privileges.
• The vulnerability requires local access, but exploitation can lead to significant impact.
• Verification of Elastic Agent versions and configurations is necessary to determine exposure.
• Remediation involves updating Elastic Agent to a version outside the vulnerable ranges.

Technical summary

The vulnerability, CVE-2026-78604, is caused by incorrect permission assignment for critical resources in Elastic Agent. This allows a local user to potentially execute arbitrary code with elevated privileges, obtaining SYSTEM-level access on Windows hosts where the agent is installed in unprivileged mode. The vulnerability affects Elastic Agent versions 8.0.0 to 8.19.21, 9.0.0 to 9.4.6, and 9.5.0 to 9.5.2. Defenders should verify these versions and update to a safe version to prevent exploitation. The vulnerability requires local access but can lead to significant impact if exploited.

Defensive priority

Defenders should prioritize verifying Elastic Agent installations, especially on Windows systems, and ensure they are updated to a version outside the vulnerable ranges (8.0.0 to 8.19.21, 9.0.0 to 9.4.6, and 9.5.0 to 9.5.2).

Recommended defensive actions

• Verify Elastic Agent version and update if necessary to a version outside the vulnerable ranges.
• Review and adjust permissions for Elastic Agent resources to prevent local privilege escalation.
• Monitor for suspicious activity on Windows systems with Elastic Agent installed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. A vendor advisory is also available. The vulnerability affects Elastic Agent versions 8.0.0 to 8.19.21, 9.0.0 to 9.4.6, and 9.5.0 to 9.5.2. Defenders should verify these versions and update to a safe version. Evidence from the CVE Program and NVD detail page supports this assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.