CVE-2025-37735: Elastic Defend Privilege Escalation Flaw

CVE-2025-37735 Overview

CVE-2025-37735 affects Elastic Defend on Windows hosts. The vulnerability stems from improper preservation of permissions [CWE-281] in the Defend service. An authenticated local attacker can leverage the flaw to have the Defend service, running as SYSTEM, delete arbitrary files on the host. In some cases, this file deletion can be chained to achieve local privilege escalation to SYSTEM. Elastic addressed the issue in security update ESA-2025-23, released across Elastic Defend versions 8.19.6, 9.1.6, and 9.2.0.

Critical Impact
A low-privileged local user can trigger the SYSTEM-level Elastic Defend service to delete arbitrary files, potentially escalating privileges to SYSTEM on affected Windows hosts.

Affected Products

Elastic Defend on Windows prior to 8.19.6
Elastic Defend on Windows 9.1.x prior to 9.1.6
Elastic Defend on Windows 9.2.x prior to 9.2.0

Discovery Timeline

2025-11-06 - CVE-2025-37735 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-37735

Vulnerability Analysis

Elastic Defend on Windows runs a service with SYSTEM privileges to perform endpoint protection tasks, including quarantine, cleanup, and remediation actions that involve file operations. The vulnerability arises because the Defend service does not properly preserve or validate file and directory permissions before performing delete operations. A local user with limited privileges can influence the paths or targets the service operates on, causing the SYSTEM-level process to remove files the user could not otherwise delete.

Arbitrary file deletion by a SYSTEM process is a well-documented primitive for local privilege escalation on Windows. Attackers can abuse the primitive against protected directories such as C:\Config.Msi or Windows Installer rollback artifacts to hijack privileged file creation. Exploitation requires local access, low privileges, and specific timing or path conditions, which is reflected in the high attack complexity.

Root Cause

The root cause is improper preservation of permissions [CWE-281] within the Elastic Defend Windows service. The service performs privileged file operations without adequately validating that the target paths are not user-controlled or that permissions are consistent between the requester and the operation. This mismatch allows a low-privileged caller to induce SYSTEM-level file deletion.

Attack Vector

The attack vector is local. An authenticated user with low privileges on a Windows host running a vulnerable Elastic Defend version manipulates file system state, such as symbolic links, junctions, or hard links, so that the Defend service targets attacker-chosen files during a privileged delete operation. Successful exploitation deletes files owned by SYSTEM or other high-privileged principals, which can be pivoted into full privilege escalation using known Windows arbitrary-delete-to-SYSTEM techniques.

No public proof-of-concept code has been published for this issue. Refer to the Elastic Security Update ESA-2025-23 for vendor-supplied technical details.

Detection Methods for CVE-2025-37735

Indicators of Compromise

Unexpected deletion of files in SYSTEM-owned paths such as C:\Windows\System32, C:\Config.Msi, or C:\ProgramData on hosts running vulnerable Elastic Defend versions.
Creation of NTFS junctions, symbolic links, or hard links by low-privileged users in directories accessed by the Elastic Defend service.
Elastic Defend service events (elastic-endpoint.exe) performing file delete operations on paths outside its expected working directories.

Detection Strategies

Monitor Windows Sysmon Event ID 23 (FileDelete) and Event ID 26 (FileDeleteDetected) where the initiating process is the Elastic Defend service and the target path is outside its install and quarantine directories.
Correlate reparse point creation events (Event ID 4663 with WriteAttributes access) by non-administrative users immediately preceding Defend service file operations.
Alert on Elastic Defend service restarts or crashes followed by missing SYSTEM-owned files.

Monitoring Recommendations

Inventory all Windows endpoints and confirm Elastic Defend agent versions against the fixed releases 8.19.6, 9.1.6, and 9.2.0.
Baseline normal file-operation behavior of the Elastic Defend service to make anomalous delete activity easier to surface.
Forward endpoint file, process, and reparse-point telemetry to a central analytics platform for retrospective hunting.

How to Mitigate CVE-2025-37735

Immediate Actions Required

Upgrade Elastic Defend on Windows to version 8.19.6, 9.1.6, or 9.2.0 or later as documented in ESA-2025-23.
Audit local user accounts on Windows endpoints and remove unnecessary interactive logon rights to reduce the local attack surface.
Review recent file deletion telemetry for Elastic Defend service activity that targets paths outside expected directories.

Patch Information

Elastic released fixes in Elastic Defend 8.19.6, 9.1.6, and 9.2.0. Patch details and download instructions are available in the Elastic Security Update ESA-2025-23 advisory.

Workarounds

No vendor-provided workaround is documented; upgrading to a fixed version is the recommended remediation.
Restrict local logon and interactive shell access on Windows endpoints running Elastic Defend until patches are deployed.
Enforce application control policies that prevent unauthorized creation of reparse points by non-administrative users.

bash

# Verify installed Elastic Defend version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Elastic*Endpoint*" } |
  Select-Object DisplayName, DisplayVersion, Publisher

# Fixed versions: 8.19.6, 9.1.6, 9.2.0 or later