3.1
CVE-2026-78587
- EPSS 0.2%
- Veröffentlicht 02.09.2026 14:43:26
- Zuletzt bearbeitet 03.09.2026 19:11:53
- Erkennungen
Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations
Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Elastic ≫ Fleet Server Version >= 8.0.0 < 8.19.16
Elastic ≫ Fleet Server Version >= 9.0.0 < 9.3.5
Elastic ≫ Fleet Server Version >= 9.4.0 < 9.4.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.2% | 0.102 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security@elastic.co | 3.1 | 1.6 | 1.4 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
|
CWE-863 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
https://discuss.elastic.co/t/fleet-server-8-19-16-9-3-5-9-4-2-security-update-esa-2026-164/390117