CVE-2026-78587
Received Received - Intake

Incorrect Authorization in Fleet Server Leading to DoS

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Elastic

Description
Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-78587
EUVD
EUVD-2026-70065

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
elastic fleet_server *
elastic fleet_server to 8.19.16 (exc)
elastic fleet_server to 9.3.5 (exc)
elastic fleet_server to 9.4.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78587 is an Incorrect Authorization vulnerability in Fleet Server where authenticated agents can interfere with upload sessions of other agents, causing denial of service for upload operations. This happens because Fleet Server fails to verify session ownership during multi-part data uploads.

Impact Analysis

This vulnerability allows authenticated users to disrupt agent upload operations, potentially causing delays or failures in data processing. It may lead to operational disruptions but does not directly expose sensitive data or allow unauthorized access.

Mitigation Strategies

Upgrade Fleet Server to versions 8.19.16, 9.3.5, or 9.4.2 or later to resolve the vulnerability. No workarounds exist for users unable to upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart