Is CVE-2026-102413 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102413 being exploited in the wild.

How severe is CVE-2026-102413?

Medium severity, with a CVSS score of 6.2, published 6 October 2026.

Which products and versions are affected?

Elastic Endpoint 8.19.13 to 8.19.21; 9.2.7 to 9.2.8; 9.3.0 to 9.3.8; 9.4.0 to 9.4.7; 9.5.0 to 9.5.4.

Is there a fix for CVE-2026-102413?

Yes: fixed in Elastic Endpoint 8.19.22, 9.4.8, and 9.5.5 (no fix available for 9.2.x and 9.3.x lines). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102413 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-102413?

Check whether you run Elastic Endpoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102413: Elastic Endpoint uncaught exception denial of service

CVE-2026-102413 · Severity: medium · CVSS 6.2 · Published 2026-10-06

Elastic Endpoint, a component of Elastic Defend that provides malware prevention and behavioral detection, can crash and restart repeatedly when processing specially crafted file names on Windows systems with certain locales (Chinese, Japanese, Korean). This causes the security protection to become unavailable on affected hosts, leaving systems without real-time threat detection until the condition is resolved.

Vendors: Elastic.

Quick answers

Is CVE-2026-102413 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102413 being exploited in the wild.
How severe is CVE-2026-102413?: Medium severity, with a CVSS score of 6.2, published 6 October 2026.
Which products and versions are affected?: Elastic Endpoint 8.19.13 to 8.19.21; 9.2.7 to 9.2.8; 9.3.0 to 9.3.8; 9.4.0 to 9.4.7; 9.5.0 to 9.5.4.
Is there a fix for CVE-2026-102413?: Yes: fixed in Elastic Endpoint 8.19.22, 9.4.8, and 9.5.5 (no fix available for 9.2.x and 9.3.x lines). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102413 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-102413?: Check whether you run Elastic Endpoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Elastic Endpoint 8.19.22, 9.4.8, and 9.5.5 (no fix available for 9.2.x and 9.3.x lines)

Technical details

An uncaught exception (CWE-248) in Elastic Endpoint's file-path handling code triggers a denial of service when processing file names under specific Windows system locale configurations. The vulnerability requires no authentication or user interaction and occurs locally; a specially crafted file name causes the Endpoint process to crash repeatedly, disabling malware prevention and behavioral detection capabilities on the affected host.

Affected products

Elastic Endpoint 8.19.13 to 8.19.21; 9.2.7 to 9.2.8; 9.3.0 to 9.3.8; 9.4.0 to 9.4.7; 9.5.0 to 9.5.4

Timeline

2026-10-06: disclosed

References

https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.