CVE-2026-78604: Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM
Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls broader than required. A local user could take advantage of this to cause the service to execute code of their choosing, ultimately obtaining SYSTEM-level privileges on the host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
On Windows systems where Elastic Agent is installed in unprivileged mode, ensure resources used by the Elastic Agent service are created with access controls that are no broader than required (reduce ACL permissions for agent service resources to least privilege).
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Windows systems with Elastic Agent installed in unprivileged mode are affected. The issue involves overly broad access controls on resources used by the agent service.
What access does an attacker need to exploit it?
An attacker needs local access as a user on the affected Windows host. They can replace or modify accessible resources so that the Elastic Agent service executes attacker-controlled code with SYSTEM-level privileges.