Description

Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls broader than required. A local user could take advantage of this to cause the service to execute code of their choosing, ultimately obtaining SYSTEM-level privileges on the host.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-02T15:17:41.670Z",
  "pubdate": "2026-09-02T15:17:41.670Z",
  "executiveSummary": "This vulnerability involves an Incorrect Permission Assignment for Critical Resource (CWE-732) within the Elastic Agent service on Windows platforms.\nThe flaw stems from insufficiently restrictive Access Control Lists (ACLs) applied to resources utilized by the agent during operation in unprivileged mode.\nAn authenticated local attacker can leverage this misconfiguration to perform binary replacement (CAPEC-642), facilitating arbitrary code execution.\nThe primary risk implication is a Local Privilege Escalation (LPE) scenario where the attacker can transition from a low-privileged user account to SYSTEM-level execution context.\nExploitation requires local access to the host system and the ability to manipulate files within the directory paths where the Elastic Agent maintains its service-related resources.\nSuccessful exploitation allows for complete system compromise, bypassing standard OS security boundaries.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of discretionary access control on the file system resources managed by the Elastic Agent service. On Windows installations, the service creates and manages directories and files with excessive permissions, allowing non-privileged users to write or modify content within these critical paths.\nThis represents a classic CWE-732 condition where the security descriptor of the resource is not restricted to the SYSTEM account or the specific service account, but rather inherits or is assigned permissions that include 'Write' or 'Modify' access for the 'Users' group.\nThe attack flow follows the CAPEC-642 (Replace Binaries) pattern. An adversary with local access identifies the service-related binaries or script components that are loaded or executed by the Elastic Agent service during its routine operation or upon service restart.\nBy replacing a legitimate, trusted binary with a malicious payload—often a DLL side-loading target, an executable, or an interpreted script—the attacker poisons the service execution chain. Because the Elastic Agent service typically runs with elevated SYSTEM privileges to perform system-wide monitoring and log collection, it inadvertently executes the attacker-supplied code with these same elevated privileges.\nThe exploitation process occurs in several distinct steps: First, the attacker enumerates the file permissions within the Elastic Agent installation directory to identify misconfigured resources. Second, the attacker overwrites a target executable or library file with a malicious counterpart. Third, the attacker triggers the Elastic Agent service to perform a task or service restart that necessitates loading the compromised file. Finally, the service executes the payload, granting the attacker a command shell or elevated execution context in the SYSTEM security principal.\nThe post-exploitation impact is severe, as it provides the attacker with full control over the host operating system. This grants the ability to bypass endpoint detection, access sensitive data, install persistent backdoors, or move laterally within the network, effectively subverting the security posture of the affected host."
}