CVE-2026-78587: fallo de gravedad baja en Elastic Fleet Server
Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 3.1epss 0.3%
Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Productos afectados
Elastic · Fleet ServerCVEs relacionadas — Elastic Fleet Server
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-46667HIGHFleet Server Insertion of Sensitive Information into Log FileEPSS 0.7%CVE-2026-72676MEDIUMImproper Control of Generation of Code in Fleet Server Leading to Code InjectionEPSS 0.5%CVE-2026-56150MEDIUMAllocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of ServiceEPSS 0.5%CVE-2026-72657MEDIUMAuthorization Bypass Through User-Controlled Key in Fleet Server Leading to Information DisclosureEPSS 0.4%CVE-2023-31421MEDIUMBeats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issueEPSS 0.3%CVE-2024-52975CRITICALFleet Server sensitive information exposure via logsEPSS 0.3%