low3.1
CVE-2026-78587
Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122).
Impact
Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Elastic | Fleet Server | from 8.0.0 before 8.19.16 from 9.0.0 before 9.3.5 from 9.4.0 before 9.4.2 |