CVE-2026-78604 Elastic CVE debrief

Who should care

System administrators and security teams responsible for Elastic Agent installations, especially on Windows systems, should be aware of this vulnerability and take immediate action to apply the security update and review access controls.

Technical summary

CVE-2026-78604 is an Incorrect Permission Assignment for Critical Resource vulnerability in Elastic Agent. This vulnerability can lead to local privilege escalation on Windows systems where Elastic Agent is installed in unprivileged mode. The resources used by the agent service are created with access controls broader than required, allowing a local user to execute code of their choosing and obtain SYSTEM-level privileges on the host.

Defensive priority

This vulnerability allows for local privilege escalation on Windows systems where Elastic Agent is installed in unprivileged mode. Immediate attention is required to prevent potential exploitation.

Recommended defensive actions

• Apply the security update provided by Elastic to address the vulnerability in Elastic Agent.
• Ensure Elastic Agent is installed and running with the latest version, specifically 8.19.22 or later, 9.4.7 or later, or 9.5.3 or later.
• Review and adjust the access controls and permissions for Elastic Agent resources to prevent broader access than required.
• Monitor systems for any suspicious activity that could indicate exploitation of this vulnerability.
• Implement compensating controls such as restricting local user privileges to minimize the risk of exploitation.

Evidence notes

The CVE-2026-78604 vulnerability in Elastic Agent allows for local privilege escalation via Replace Binaries. On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls broader than required. A local user could take advantage of this to cause the service to execute code of their choosing, ultimately obtaining SYSTEM-level privileges on the host. Elastic has provided a security update to address this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.