Improper Permission Management in Elastic Defend on Windows Systems

CVE-2025-37735

What is CVE-2025-37735?

The Elastic Defend service on Windows operating systems exhibits flaws in its permission management. This vulnerability can allow arbitrary files on the system to be deleted by the Defend service, which operates with SYSTEM privileges. Such behavior increases the risk of local privilege escalation, as it allows attackers to manipulate files that should be secure. Organizations using affected versions should prioritize applying the latest security updates to mitigate this risk.

References