CVE WatchSep 4, 2026

CVE-2026-78604

Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries

CVSS

7.8

High

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Sep 2, 2026 · Last modified: Sep 4, 2026 · CWE-732

EPSS · 30d

0.1%EPSS · 30 days0.1%

2026-10-022026-10-29

Technical description

Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls broader than required. A local user could take advantage of this to cause the service to execute code of their choosing, ultimately obtaining SYSTEM-level privileges on the host.

Official references

discuss.elastic.cohttps://discuss.elastic.co/t/elastic-agent-8-19-21-9-4-6-9-5-2-security-update-esa-2026-150/390109

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1114995.5 MED

—

———Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.9h CVE-2026-118574—

—

——0Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.6h CVE-2026-1070609.1 CRI

—

——0Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.7h CVE-2026-1070557.5 HIG

—

——0Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.6h CVE-2026-1070477.5 HIG

—

——0Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.6h CVE-2026-1070447.5 HIG

—

——0Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.6h