Is CVE-2026-56150 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56150 being exploited in the wild.

How severe is CVE-2026-56150?

Medium severity, with a CVSS score of 6.5, published 1 July 2026.

Which products and versions are affected?

Elastic Fleet Server 8.0.0 to 8.19.10, 9.0.0 to 9.2.4.

Is there a fix for CVE-2026-56150?

A patch was published on 2026-07-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56150 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-56150?

Check whether you run Elastic Fleet Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56150: Elastic Fleet Server denial of service via excessive memory allocation

CVE-2026-56150 · Severity: medium · CVSS 6.5 · Published 2026-07-01

Elastic Fleet Server, which centrally manages Elastic Agents, is vulnerable to a denial-of-service attack. An attacker can send a specifically designed request to a file upload endpoint that forces the server to consume excessive memory. This can cause the server to crash or become unresponsive, disrupting the management of security agents across the organization.

Technologies: Elastic Fleet Server. Vendors: Elastic.

Quick answers

Is CVE-2026-56150 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56150 being exploited in the wild.
How severe is CVE-2026-56150?: Medium severity, with a CVSS score of 6.5, published 1 July 2026.
Which products and versions are affected?: Elastic Fleet Server 8.0.0 to 8.19.10, 9.0.0 to 9.2.4.
Is there a fix for CVE-2026-56150?: A patch was published on 2026-07-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56150 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56150?: Check whether you run Elastic Fleet Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability (CWE-770) exists in Elastic Fleet Server's upload endpoint. The component fails to properly throttle or limit memory allocation during certain request types, leading to Excessive Allocation (CAPEC-130). An attacker with low-level authenticated access can submit a specially crafted request that exhausts available system memory, resulting in a denial-of-service (DoS) condition. The vulnerability is reachable over the network and does not require user interaction. Patches are available in versions 8.19.11, 9.2.5, and 9.3.0.

Affected products

Elastic Fleet Server 8.0.0 to 8.19.10, 9.0.0 to 9.2.4

Timeline

2026-07-01: disclosed
2026-07-01: advisory
2026-07-01: patched

References

https://discuss.elastic.co/t/fleet-server-8-19-11-9-2-5-9-3-0-security-update-esa-2026-44

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.