CVE-2026-102413 Uncaught Exception in Elastic Endpoint Leading to Denial of Service
An attacker can cause a denial of service in Elastic Endpoint by triggering an unhandled exception via a crafted file name in specific locales.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-102413?
CVE-2026-102413 is a medium-severity denial of service vulnerability in Elastic Agent and Elastic Defend, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend's real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists.
Weakness: CWE-248
Which versions are affected by CVE-2026-102413?
How do I fix CVE-2026-102413?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-102413 being exploited?
There is no known exploitation of CVE-2026-102413 in the wild and no public exploit code.
Sources
Also known as GHSA-f8hp-h7qq-64mp, MINI-8xf8-h78v-qhgw, MINI-h935-74wr-j26x, MINI-xf5p-qc7x-r28r.