EUVD-2026-70065
GHSA-cg8q-4j53-92fq
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Matches vendor vector: authenticated enrolled agent (PR:L), timing-dependent session race (AC:H), no confidentiality or integrity impact, low availability disruption only.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.
AnalysisAI
Incorrect authorization in Elastic Fleet Server allows any authenticated enrolled agent to interfere with multi-part upload sessions belonging to other enrolled agents, causing a denial of service of those upload operations. Fleet Server fails to verify session ownership during chunked data uploads, meaning a low-privileged agent credential is sufficient to disrupt peer agent activity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an authenticated Elastic Agent credential with PR:L - the attacker must control or have compromised an enrolled agent, not merely have network access; (2) a concurrent active multi-part upload session from a different enrolled agent must be in progress at the time of attack (AC:H timing condition); and (3) network access to the Fleet Server upload API endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L honestly reflects a limited-impact, difficult-to-trigger flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Elastic-released patches documented in advisory ESA-2026-164 at https://discuss.elastic.co/t/fleet-server-8-19-16-9-3-5-9-4-2-security-update-esa-2026-164/390117. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fleet Server
View allAn issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into th
Denial of service in Elastic Fleet Server (versions 8.0.0-8.19.10 and 9.0.0-9.2.4) allows remote attackers to exhaust me
Server-side code injection in Elastic Fleet Server (8.5.0-8.19.19, 9.0.0-9.4.4, and 9.5.0) lets an actor who can define
Policy information disclosure in Elastic Fleet Server allows any enrolled agent with valid credentials to retrieve polic
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today