# APM Java Agent Security Update

**URL:** <https://discuss.elastic.co/t/apm-java-agent-security-update/291355>\
**Category:** Security Announcements\
**Created:** [December 9, 2021, 5:25pm UTC](https://discuss.elastic.co/t/apm-java-agent-security-update/291355 "2021-12-09T17:25:33Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![douglasday](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/douglasday/32/74044_2.png) [@douglasday](https://discuss.elastic.co/u/douglasday)\
**Post date:** [December 9, 2021, 5:25pm UTC](https://discuss.elastic.co/t/apm-java-agent-security-update/291355/1 "2021-12-09T17:25:33Z")

</div>

**APM Java Agent Local Privilege Escalation issue (ESA-2021-30)**

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.

**Affected Versions:**

Versions 1.18.0 through 1.27.0

**Solutions and Mitigations:**

Update to 1.27.1 or newer or use the unaffected [-javaagent-based installation method](https://www.elastic.co/guide/en/apm/agent/java/current/setup-javaagent.html)

**CVSSv3:** 7.0 - AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

**CVE ID:** CVE-2021-37942

---

_[View the full topic](https://discuss.elastic.co/t/apm-java-agent-security-update/291355)._