CVE-2026-78604

Name of the Vulnerable Software and Affected Versions Elastic Agent (affected versions not specified)

Description Incorrect permission assignment for critical resources in Elastic Agent allows for local privilege escalation via binary replacement. On Windows systems where the agent is installed in unprivileged mode, the service creates resources with overly broad access controls. A local user can exploit this to force the service to execute arbitrary code, resulting in the acquisition of SYSTEM-level privileges on the host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.