CVE-2024-14047
Received Received - Intake

Winlogbeat Windows Installer Local Privilege Escalation

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Elastic

Description
A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2024-14047
EUVD
EUVD-2024-55738

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
elastic winlogbeat *
elastic winlogbeat 8.13.0
elastic winlogbeat From 7.6.0 (inc) to 8.12.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a local vulnerability in the Winlogbeat Windows installer where runtime files are placed in a directory writable by unprivileged users. A low-privileged attacker could create malicious filesystem links to trick Winlogbeat into writing or deleting arbitrary files during elevated operations, potentially causing a denial of service.

Detection Guidance

Detecting this vulnerability requires checking the installed Winlogbeat version on Windows systems using the MSI installer. Run 'winlogbeat version' in Command Prompt to verify if the version is below 8.13.0. Additionally, monitor for unusual file operations or access patterns in directories where Winlogbeat writes files.

Impact Analysis

If exploited, this vulnerability could allow an attacker to disrupt Winlogbeat operations by deleting or overwriting critical files, leading to service outages. It requires the attacker to already have low-level access to the system.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized file manipulation or deletion on systems where Winlogbeat is installed. If exploited, it may lead to data integrity issues or service disruption, which could violate requirements for data protection and availability under these regulations.

Mitigation Strategies

Immediately upgrade Winlogbeat to version 8.13.0 or later on all affected Windows systems. Since no workarounds exist for unpatched versions, updating is the only mitigation. Ensure the upgrade is applied to all instances using the MSI installer from versions 7.6.0 to 8.12.2.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-14047. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart