CVE-2026-78604: Elastic Agent Privilege Escalation Vulnerability

CVE-2026-78604 Overview

CVE-2026-78604 is a local privilege escalation vulnerability in Elastic Agent running on Windows in unprivileged mode. The agent creates service resources with permissive access controls, allowing a local user to replace or modify binaries used by the service. When the service executes those resources, the attacker gains SYSTEM-level privileges on the host. The flaw is tracked as Incorrect Permission Assignment for Critical Resource [CWE-732] and maps to the Replace Binaries technique [CAPEC-642]. Elastic addressed the issue in Elastic Agent versions 8.19.21, 9.4.6, and 9.5.2.

Critical Impact
A low-privileged local user can escalate to SYSTEM by hijacking files or directories used by the Elastic Agent service on Windows hosts running in unprivileged mode.

Affected Products

Elastic Agent on Windows installed in unprivileged mode (versions prior to 8.19.21)
Elastic Agent on Windows installed in unprivileged mode (versions prior to 9.4.6)
Elastic Agent on Windows installed in unprivileged mode (versions prior to 9.5.2)

Discovery Timeline

2026-09-02 - CVE-2026-78604 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-78604

Vulnerability Analysis

Elastic Agent supports an unprivileged installation mode on Windows that runs agent components under a lower-privileged service account. During installation, the agent provisions directories and files used by the service. These resources are created with access control lists (ACLs) that grant write access to identities beyond what the service requires.

A local user with standard privileges can identify a writable resource that the SYSTEM-level agent service consumes at runtime. By replacing a binary, dynamic-link library (DLL), or configuration file that the service loads or executes, the attacker causes the service to run attacker-controlled code. Because the service itself runs with SYSTEM privileges even in unprivileged installations, the substituted code inherits SYSTEM.

Root Cause

The root cause is Incorrect Permission Assignment for Critical Resource [CWE-732]. Files and directories that the Elastic Agent service depends on inherit or are assigned ACLs broader than necessary. Standard users retain write access to resources that should only be modifiable by administrators or the service identity.

Attack Vector

The attack requires local access and low privileges on the Windows host. The attacker does not need user interaction. The exploitation pattern follows CAPEC-642 Replace Binaries: enumerate service-owned files, identify one with weak ACLs, overwrite it with a malicious payload, and wait for or trigger service execution. On next service load or scheduled invocation, the payload runs as SYSTEM.

No verified public exploit code is available. See the Elastic Security Update Discussion for vendor technical details.

Detection Methods for CVE-2026-78604

Indicators of Compromise

Unexpected modifications to files or directories under the Elastic Agent installation path on Windows hosts
New or replaced executables and DLLs in the agent working directory owned or written by non-administrative users
Elastic Agent service processes spawning unexpected child processes with SYSTEM privileges
Windows Security event ID 4663 (object access) on agent resources from unexpected user contexts

Detection Strategies

Audit ACLs on Elastic Agent installation directories and flag any entries granting write access to Users, Authenticated Users, or Everyone.
Monitor for file write events targeting agent binaries by processes not running as SYSTEM or Administrator.
Correlate service restart events with recent file modifications in the agent directory to identify replacement attempts.

Monitoring Recommendations

Enable Windows object access auditing (event IDs 4656, 4663, 4670) on the Elastic Agent installation path.
Alert on Elastic Agent child processes that are not part of the expected component set.
Track service configuration changes and binary path modifications for the Elastic Agent Windows service.

How to Mitigate CVE-2026-78604

Immediate Actions Required

Upgrade Elastic Agent to version 8.19.21, 9.4.6, or 9.5.2 or later on all Windows hosts.
Inventory Windows hosts running Elastic Agent in unprivileged mode and prioritize them for patching.
Review ACLs on existing agent installation directories and remove excessive write permissions granted to non-administrative principals.

Patch Information

Elastic released fixed versions 8.19.21, 9.4.6, and 9.5.2 addressing this vulnerability. Refer to the Elastic Security Update Discussion (ESA-2026-150) for the official advisory and upgrade guidance.

Workarounds

If immediate patching is not possible, manually tighten ACLs on the Elastic Agent installation directory so that only SYSTEM and Administrators have write access.
Restrict interactive and local logon rights on servers running Elastic Agent to reduce the pool of users able to exploit the flaw.
Consider reinstalling Elastic Agent in privileged mode after evaluating operational impact, per vendor guidance.

bash

# Example: audit ACLs on Elastic Agent directory using PowerShell
Get-Acl 'C:\Program Files\Elastic\Agent' | Format-List
# Remove write access for standard users (run as Administrator)
$acl = Get-Acl 'C:\Program Files\Elastic\Agent'
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule('BUILTIN\Users','Write','Deny')
$acl.AddAccessRule($rule)
Set-Acl 'C:\Program Files\Elastic\Agent' $acl