Vulnerability · Published Sep 2, 2026 · Assigned by elastic
CVE-2026-78604Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM
High 7.8
In plain English
A high-severity incorrect permission assignment in Elastic Agent from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Official description
Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls broader than required. A local user could take advantage of this to cause the service to execute code of their choosing, ultimately obtaining SYSTEM-level privileges on the host.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Elastic Agent | 8.0.0 – through 8.19.209.0.0 – through 9.4.59.5.0 – through 9.5.1 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H