High-Severity Elastic Defend Flaw (CVE-2025-37735) Allows Local Attackers to Delete Arbitrary Files as SYSTEM

Elastic has issued security updates for Elastic Defend to address a high-severity flaw tracked as CVE-2025-37735, described as Improper Preservation of Permissions with a CVSS of 7.0. According to the advisory, improper preservation of permissions on Windows hosts can allow arbitrary files on the system to be deleted by the Defend service running as SYSTEM, potentially enabling local privilege escalation.

The issue affects multiple branches of Elastic Defend, including 8.x and 9.x releases, making it a serious local privilege escalation vector for environments where attackers already have a foothold. Elastic urges users to upgrade to the patched releases 8.19.6, 9.1.6, or 9.2.0, while offering a temporary mitigation for those unable to deploy updates. As a partial protection, Windows 11 24H2 users are advised that upgrading to Windows 11 24H2 or later can reduce exploitability, though it is not a complete fix.