Elastic Defend for Windows Vulnerability Allows Threat Actors to Gain Elevated Access

Elastic Defend for Windows has a vulnerability tracked as CVE-2025-37735 that could allow local attackers to escalate privileges on affected systems, stemming from improper preservation of file permissions by the Defend service. According to Elastic, the flaw exists in how the Defend service, which runs with SYSTEM-level privileges, processes files on Windows hosts and can enable local privilege escalation or the deletion of arbitrary system files.

The vulnerability affects Elastic Defend for Windows, with affected versions 8.19.5 and earlier and 9.0.0 through 9.1.5; fixed versions are 8.19.6, 9.1.6 and 9.2.0, and the CVSS v3.1 score is 7.0. The attack requires local access and moderate complexity but only low privileges are needed to execute, making it a realistic risk in many environments.

Elastic notes that Windows 11 version 24H2 includes architectural changes that complicate exploitation, and organisations are advised to upgrade to one of the fixed versions or apply the provided workaround where necessary.