Vulnerability-Lookup

CVE-2026-102413 (GCVE-0-2026-102413)

Vulnerability from cvelistv5 – Published: 2026-10-06 19:31 – Updated: 2026-10-06 19:54

Title

Uncaught Exception in Elastic Endpoint Leading to Denial of Service

Summary

Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend's real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 19:53 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

elastic mitre root Scorecard

References

1 reference

URL	Tags
https://discuss.elastic.co/t/elastic-agent-endpoi…

Impacted products

1 product

Vendor	Product	Version
Elastic	Elastic Agent and Elastic Defend	Affected: 8.19.13 , ≤ 8.19.21 (semver) Affected: 9.2.7 , ≤ 9.2.8 (semver) Affected: 9.3.0 , ≤ 9.3.8 (semver) Affected: 9.4.0 , ≤ 9.4.7 (semver) Affected: 9.5.0 , ≤ 9.5.4 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102413",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T19:53:58.090433Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T19:54:08.886Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Elastic Agent and Elastic Defend",
          "vendor": "Elastic",
          "versions": [
            {
              "lessThanOrEqual": "8.19.21",
              "status": "affected",
              "version": "8.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.2.8",
              "status": "affected",
              "version": "9.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.3.8",
              "status": "affected",
              "version": "9.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.4.7",
              "status": "affected",
              "version": "9.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.5.4",
              "status": "affected",
              "version": "9.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend\u0027s Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend\u0027s real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists.\u003c/p\u003e"
            }
          ],
          "value": "Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend\u0027s Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend\u0027s real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248 Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T19:31:46.232Z",
        "orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
        "shortName": "elastic"
      },
      "references": [
        {
          "url": "https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868"
        }
      ],
      "source": {
        "discovery": "Elastic"
      },
      "title": "Uncaught Exception in Elastic Endpoint Leading to Denial of Service",
      "x_generator": {
        "engine": "Elastic CVE Publisher 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
    "assignerShortName": "elastic",
    "cveId": "CVE-2026-102413",
    "datePublished": "2026-10-06T19:31:46.232Z",
    "dateReserved": "2026-09-29T02:06:02.426Z",
    "dateUpdated": "2026-10-06T19:54:08.886Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-102413",
      "date": "2026-10-07",
      "epss": "0.00131",
      "percentile": "0.02333"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Elastic Agent and Elastic Defend",
                "vendor": "Elastic",
                "versions": [
                  {
                    "lessThanOrEqual": "8.19.21",
                    "status": "affected",
                    "version": "8.19.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "9.2.8",
                    "status": "affected",
                    "version": "9.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "9.3.8",
                    "status": "affected",
                    "version": "9.3.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "9.4.7",
                    "status": "affected",
                    "version": "9.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "9.5.4",
                    "status": "affected",
                    "version": "9.5.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@elastic.co"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend\u0027s Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend\u0027s real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists."
          }
        ],
        "id": "CVE-2026-102413",
        "lastModified": "2026-10-07T13:42:52.070",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.2,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 3.6,
              "source": "security@elastic.co",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-102413",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T19:53:58.090433Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-06T20:17:13.463",
        "references": [
          {
            "source": "security@elastic.co",
            "url": "https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868"
          }
        ],
        "sourceIdentifier": "security@elastic.co",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-248"
              }
            ],
            "source": "security@elastic.co",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-102413",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-06T19:53:58.090433Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-06T19:54:04.515Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Elastic Agent and Elastic Defend",
              "vendor": "Elastic",
              "versions": [
                {
                  "lessThanOrEqual": "8.19.21",
                  "status": "affected",
                  "version": "8.19.13",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "9.2.8",
                  "status": "affected",
                  "version": "9.2.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "9.3.8",
                  "status": "affected",
                  "version": "9.3.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "9.4.7",
                  "status": "affected",
                  "version": "9.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "9.5.4",
                  "status": "affected",
                  "version": "9.5.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eUncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend\u0027s Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend\u0027s real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists.\u003c/p\u003e"
                }
              ],
              "value": "Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend\u0027s Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend\u0027s real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.2,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-248",
                  "description": "CWE-248 Uncaught Exception",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-06T19:31:46.232Z",
            "orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
            "shortName": "elastic"
          },
          "references": [
            {
              "url": "https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868"
            }
          ],
          "source": {
            "discovery": "Elastic"
          },
          "title": "Uncaught Exception in Elastic Endpoint Leading to Denial of Service",
          "x_generator": {
            "engine": "Elastic CVE Publisher 1.0.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
        "assignerShortName": "elastic",
        "cveId": "CVE-2026-102413",
        "datePublished": "2026-10-06T19:31:46.232Z",
        "dateReserved": "2026-09-29T02:06:02.426Z",
        "dateUpdated": "2026-10-06T19:54:08.886Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-1276

Vulnerability from certfr_avis - Published: 2026-10-07 - Updated: 2026-10-07

De multiples vulnérabilités ont été découvertes dans les produits Elastic. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Elastic	Elasticsearch	Elasticsearch versions antérieures à 8.19.23
Elastic	Kibana	Kibana versions 9.5.x antérieures à 9.5.5
Elastic	Elastic Agent	Elastic Agent versions antérieures à 8.19.22
Elastic	Elasticsearch	Elasticsearch versions 9.x antérieures à 9.4.8
Elastic	Kibana	Kibana versions antérieures à 8.19.22
Elastic	Elastic Agent	Elastic Agent versions 9.x antérieures à 9.4.8
Elastic	Kibana	Kibana versions 9.x antérieures à 9.4.8
Elastic	Elastic Agent	Elastic Agent versions 9.5.x antérieures à 9.5.5
Elastic	Elasticsearch	Elasticsearch versions 9.5.x antérieures à 9.5.5

References

Title

Publication Time

Tags

Bulletin de sécurité Elastic 390866	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390872	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390862	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390871	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390869	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390863	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390861	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390859	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390864	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390870	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390860	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390868	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390874	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390865	2026-10-06	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Elasticsearch versions ant\u00e9rieures \u00e0 8.19.23",
      "product": {
        "name": "Elasticsearch",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Kibana versions 9.5.x ant\u00e9rieures \u00e0 9.5.5",
      "product": {
        "name": "Kibana",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Agent versions ant\u00e9rieures \u00e0 8.19.22",
      "product": {
        "name": "Elastic Agent",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elasticsearch versions 9.x ant\u00e9rieures \u00e0 9.4.8",
      "product": {
        "name": "Elasticsearch",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Kibana versions ant\u00e9rieures \u00e0 8.19.22",
      "product": {
        "name": "Kibana",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Agent versions 9.x ant\u00e9rieures \u00e0 9.4.8",
      "product": {
        "name": "Elastic Agent",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Kibana versions 9.x ant\u00e9rieures \u00e0 9.4.8",
      "product": {
        "name": "Kibana",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Agent versions 9.5.x ant\u00e9rieures \u00e0 9.5.5",
      "product": {
        "name": "Elastic Agent",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elasticsearch versions 9.5.x ant\u00e9rieures \u00e0 9.5.5",
      "product": {
        "name": "Elasticsearch",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-102406",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102406"
    },
    {
      "name": "CVE-2026-103006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103006"
    },
    {
      "name": "CVE-2026-102404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102404"
    },
    {
      "name": "CVE-2026-103009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103009"
    },
    {
      "name": "CVE-2026-102410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102410"
    },
    {
      "name": "CVE-2026-102409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102409"
    },
    {
      "name": "CVE-2026-102412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102412"
    },
    {
      "name": "CVE-2026-102408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102408"
    },
    {
      "name": "CVE-2026-103005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103005"
    },
    {
      "name": "CVE-2026-103008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103008"
    },
    {
      "name": "CVE-2026-102407",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102407"
    },
    {
      "name": "CVE-2026-102413",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102413"
    },
    {
      "name": "CVE-2026-103007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103007"
    },
    {
      "name": "CVE-2026-102411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102411"
    }
  ],
  "initial_release_date": "2026-10-07T00:00:00",
  "last_revision_date": "2026-10-07T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1276",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-07T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Elastic. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Elastic",
  "vendor_advisories": [
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390866",
      "url": "https://discuss.elastic.co/t/kibana-9-4-8-9-5-5-security-update-esa-2026-193/390866"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390872",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-198/390872"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390862",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-189/390862"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390871",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-197/390871"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390869",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-195/390869"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390863",
      "url": "https://discuss.elastic.co/t/elasticsearch-9-4-8-9-5-5-security-update-esa-2026-190/390863"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390861",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-188/390861"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390859",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-185/390859"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390864",
      "url": "https://discuss.elastic.co/t/kibana-9-4-0-security-update-esa-2026-191/390864"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390870",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-2-security-update-esa-2026-196/390870"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390860",
      "url": "https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390868",
      "url": "https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390874",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-199/390874"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390865",
      "url": "https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-3-8-19-23-security-update-esa-2026-192/390865"
    }
  ]
}

EUVD-2026-384005

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-06 20:15

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-06T20:15:54.754031+00:00",
  "id": "EUVD-2026-384005"
}

FKIE_CVE-2026-102413

Vulnerability from fkie_nvd - Published: 2026-10-06 20:17 - Updated: 2026-10-07 13:42

Severity

6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security@elastic.co	https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Elastic Agent and Elastic Defend",
          "vendor": "Elastic",
          "versions": [
            {
              "lessThanOrEqual": "8.19.21",
              "status": "affected",
              "version": "8.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.2.8",
              "status": "affected",
              "version": "9.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.3.8",
              "status": "affected",
              "version": "9.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.4.7",
              "status": "affected",
              "version": "9.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.5.4",
              "status": "affected",
              "version": "9.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@elastic.co"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend\u0027s Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend\u0027s real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists."
    }
  ],
  "id": "CVE-2026-102413",
  "lastModified": "2026-10-07T13:42:52.070",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6,
        "source": "security@elastic.co",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-102413",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-06T19:53:58.090433Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-06T20:17:13.463",
  "references": [
    {
      "source": "security@elastic.co",
      "url": "https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868"
    }
  ],
  "sourceIdentifier": "security@elastic.co",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        }
      ],
      "source": "security@elastic.co",
      "type": "Secondary"
    }
  ]
}

GHSA-F8HP-H7QQ-64MP

Vulnerability from github – Published: 2026-10-06 21:31 – Updated: 2026-10-06 21:31

Details

Severity

6.2 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-102413"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-06T20:17:13Z",
    "severity": "MODERATE"
  },
  "details": "Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend\u0027s Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend\u0027s real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists.",
  "id": "GHSA-f8hp-h7qq-64mp",
  "modified": "2026-10-06T21:31:56Z",
  "published": "2026-10-06T21:31:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102413"
    },
    {
      "type": "WEB",
      "url": "https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-102413 (GCVE-0-2026-102413)

CERTFR-2026-AVI-1276

Solutions

EUVD-2026-384005

FKIE_CVE-2026-102413

GHSA-F8HP-H7QQ-64MP

Tags

Sightings

Nomenclature

Related by attack behaviour