CVE-2026-102413

MediumCVSS 6.2/10Last modified Oct 7, 2026

Description

Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend's real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Elastic	Elastic Agent and Elastic Defend	>= 8.19.13, <= 8.19.21; >= 9.2.7, <= 9.2.8; >= 9.3.0, <= 9.3.8; >= 9.4.0, <= 9.4.7; >= 9.5.0, <= 9.5.4

References

https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868

Timeline

Published: Oct 6, 2026
Last modified: Oct 7, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-1024143.7pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A CVE-2026-102426.3A weakness has been identified in itsourcecode Content Management System 1.0. This impacts an unknown function of the file /instructions.php CVE-2026-1024228.1shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, inc CVE-2026-1024247.5Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.CVE-2026-10242510.0Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports admin CVE-2026-1024266.1Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider mi CVE-2026-10242710.0Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached throu CVE-2026-1024289.8Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user prov CVE-2026-102437.3A security vulnerability has been detected in code-projects Smart Parking System 1.0. Affected is an unknown function of the component Admin CVE-2026-1024359.8The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation i CVE-2026-1024377.8OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a l CVE-2026-1024388.5An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges