Elastic Endpoint CVE-2026-102413

Exploitation requires three concrete conditions drawn from the description: (1) the target is a Windows host running Elastic Defend with the Elastic Endpoint component active; (2) the host's system locale is set to a CJK locale (Chinese, Japanese, or Korean) - the flaw does not trigger under other locale configurations; and (3) a file with a specifically crafted file name reaches a location Elastic Endpoint processes during file-path handling. The CJK-locale requirement is the primary limiting factor and is a deployment condition outside the attacker's direct control, so hosts on non-CJK locales are not exploitable. No authentication and no user interaction are required per the CVSS vector (PR:N/UI:N), but local access/file delivery to the host is needed (AV:L). Impact is limited to availability of the endpoint protection (and transitively the host's defensive posture); there is no code execution, data disclosure, or data modification.

This is a moderate-priority, availability-only issue rather than a high-impact breach risk. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.2) reflects a local, unauthenticated denial of service with no confidentiality or integrity impact - the A:H is the sole driver. The security significance is amplified beyond a generic DoS because the crashing component is Elastic Defend's EDR agent: repeated crashes degrade or disable real-time malware prevention and behavioral detection, effectively a defense-evasion/security-control-bypass primitive that could be chained with other malware activity. No EPSS score was provided in the input, and exploitation signals are weak: there is no CISA KEV listing and no public proof-of-concept referenced, so this is best treated as 'no public exploit identified at time of analysis.' A key caveat: exploitation is gated on a specific deployment condition - the host must run a CJK (Chinese/Japanese/Korean) system locale - which sharply narrows the realistically affected population and argues the practical risk is lower than the 6.2 base score alone suggests for most English-locale environments. The vendor rated this AV:L/AC:L; I assess the locale dependency as a condition largely beyond the attacker's control, nudging effective complexity higher (see assessed vector).

An attacker who can cause a file with a specially crafted name to land on a Windows host running a Chinese, Japanese, or Korean system locale (e.g., via download, email attachment, removable media, or a writable network share that Elastic Endpoint scans) triggers an unhandled exception during file-path handling. The Elastic Endpoint process crashes and restarts in a loop, leaving the host without active malware prevention and behavioral detection for as long as the crafted file remains present. No public exploit code is identified at time of analysis.