CVE-2024-52976

7.8 highEPSS 0.2%

High (7.8) in elastic elastic agent. EPSS 0.2% chance of exploitation in the next 30 days.

Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via parameter injection. An attacker requires local access and the ability to modify osqueryd configurations.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
CWE: CWE-829
Published: 2025-05-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

elastic:elastic_agent

References

https://discuss.elastic.co/t/elastic-agent-7-17-25-and-8-15-4-security-update-esa-2024-39/377708

Check your stack JSON