Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM
Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls broader than required. A local user could take advantage of this to cause the service to execute code of their choosing, ultimately obtaining SYSTEM-level privileges on the host.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.20
- 9.x:
- All versions from 9.0.0 up to and including 9.4.5
- All versions from 9.5.0 up to and including 9.5.1
Affected Configurations:
Only Windows deployments of Elastic Agent using the unprivileged installation mode are affected. Default (privileged) installations on Windows, and all Linux and macOS deployments, are not affected.
Solutions and Mitigations:
The issue is resolved in Elastic Agent versions 8.19.21, 9.4.6, and 9.5.2.
For Users that Cannot Upgrade:
Users who cannot immediately upgrade should avoid deploying Elastic Agent in unprivileged installation mode on Windows systems. Switching to a standard (privileged) installation removes the overly permissive access control configuration.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Severity: CVSSv3.1: High ( 7.8 ) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE ID: CVE-2026-78604
Problem Type: CWE-732 - Incorrect Permission Assignment for Critical Resource
Impact: CAPEC-642 - Replace Binaries