Incident : Zero-Day Vulnerability

ELA627081725

Exposure Impact

Title: Elastic EDR Zero-Day Vulnerability Leading to BSOD and System Compromise

Description: A zero-day vulnerability in Elastic’s Endpoint Detection and Response (EDR) solution, specifically in the 'elastic-endpoint-driver.sys' kernel driver (signed by Microsoft), allows attackers to bypass security measures, execute malicious code, and trigger a Blue Screen of Death (BSOD) system crash. The flaw, classified as CWE-476 (NULL Pointer Dereference), enables a four-step attack chain: EDR bypass, Remote Code Execution (RCE), persistence via a custom kernel driver, and a Privileged Persistent Denial of Service (DoS). The vulnerability was discovered by Ashes Cybersecurity and remains unpatched as of the disclosure date, posing severe risks to enterprises relying on Elastic’s SIEM and EDR solutions. The attacker can manipulate the trusted driver to exhibit malware-like behavior, disabling endpoints at scale.

Date Detected: 2025-06-02

Date Publicly Disclosed: 2025-08-16

Type: Zero-Day Vulnerability

Attack Vector: Local/Remote Code Execution via Custom LoaderKernel Driver ManipulationNULL Pointer Dereference Exploit (CWE-476)

Vulnerability Exploited: Cve Id: None, Cwe Id: CWE-476, Description: NULL Pointer Dereference in 'elastic-endpoint-driver.sys' kernel driver, allowing uncontrolled pointer dereferencing in privileged kernel routines, leading to BSOD and system compromise., Elastic DefendElastic AgentAffected Component: elastic-endpoint-driver.sys (version 8.17.6 and likely subsequent versions), Severity: Critical.

Incident : Zero-Day Vulnerability ELA627081725

Entity Name: Elasticsearch, Inc.

Entity Type: Software Vendor

Industry: Cybersecurity (SIEM/EDR)

Location: Global (HQ: Mountain View, California, USA)

Customers Affected: All organizations using Elastic Defend/Elastic Agent with vulnerable driver versions, Paying customers of Elastic (including Ashes Cybersecurity Pvt Ltd.)

Incident : Zero-Day Vulnerability ELA627081725

Third Party Assistance: Disclosure Attempts Via Hackerone (2025-06-11), Zero Day Initiative (Zdi) (2025-07-29).

Remediation Measures: No patch available as of disclosureCustomers advised to monitor for updates

Communication Strategy: Independent public disclosure by Ashes Cybersecurity (2025-08-16)

Incident : Zero-Day Vulnerability ELA627081725

Lessons Learned: Zero-day vulnerabilities in security products can undermine their core purpose, turning defensive tools into attack vectors., Kernel drivers, even when signed by trusted entities (e.g., Microsoft), can introduce critical risks if not rigorously validated., Delayed patching of disclosed vulnerabilities in widely used security software exposes enterprises to systemic risks., Transparency in disclosure timelines (e.g., HackerOne, ZDI) is critical for customer awareness and mitigation.

Incident : Zero-Day Vulnerability ELA627081725

Recommendations: Elastic should prioritize patching the NULL Pointer Dereference in 'elastic-endpoint-driver.sys' and conduct a full security audit of its kernel components., Customers should isolate or disable vulnerable Elastic EDR/Agent instances until a patch is available, and monitor for unusual system crashes or persistence mechanisms., Organizations should implement defense-in-depth strategies (e.g., additional EDR layers, behavioral monitoring) to mitigate risks from compromised security tools., Security vendors should adopt stricter code-signing practices and kernel driver validation to prevent similar exploits., Independent security researchers should be incentivized to responsibly disclose vulnerabilities through coordinated programs to reduce public exposure risks.Elastic should prioritize patching the NULL Pointer Dereference in 'elastic-endpoint-driver.sys' and conduct a full security audit of its kernel components., Customers should isolate or disable vulnerable Elastic EDR/Agent instances until a patch is available, and monitor for unusual system crashes or persistence mechanisms., Organizations should implement defense-in-depth strategies (e.g., additional EDR layers, behavioral monitoring) to mitigate risks from compromised security tools., Security vendors should adopt stricter code-signing practices and kernel driver validation to prevent similar exploits., Independent security researchers should be incentivized to responsibly disclose vulnerabilities through coordinated programs to reduce public exposure risks.Elastic should prioritize patching the NULL Pointer Dereference in 'elastic-endpoint-driver.sys' and conduct a full security audit of its kernel components., Customers should isolate or disable vulnerable Elastic EDR/Agent instances until a patch is available, and monitor for unusual system crashes or persistence mechanisms., Organizations should implement defense-in-depth strategies (e.g., additional EDR layers, behavioral monitoring) to mitigate risks from compromised security tools., Security vendors should adopt stricter code-signing practices and kernel driver validation to prevent similar exploits., Independent security researchers should be incentivized to responsibly disclose vulnerabilities through coordinated programs to reduce public exposure risks.Elastic should prioritize patching the NULL Pointer Dereference in 'elastic-endpoint-driver.sys' and conduct a full security audit of its kernel components., Customers should isolate or disable vulnerable Elastic EDR/Agent instances until a patch is available, and monitor for unusual system crashes or persistence mechanisms., Organizations should implement defense-in-depth strategies (e.g., additional EDR layers, behavioral monitoring) to mitigate risks from compromised security tools., Security vendors should adopt stricter code-signing practices and kernel driver validation to prevent similar exploits., Independent security researchers should be incentivized to responsibly disclose vulnerabilities through coordinated programs to reduce public exposure risks.Elastic should prioritize patching the NULL Pointer Dereference in 'elastic-endpoint-driver.sys' and conduct a full security audit of its kernel components., Customers should isolate or disable vulnerable Elastic EDR/Agent instances until a patch is available, and monitor for unusual system crashes or persistence mechanisms., Organizations should implement defense-in-depth strategies (e.g., additional EDR layers, behavioral monitoring) to mitigate risks from compromised security tools., Security vendors should adopt stricter code-signing practices and kernel driver validation to prevent similar exploits., Independent security researchers should be incentivized to responsibly disclose vulnerabilities through coordinated programs to reduce public exposure risks.

Incident : Zero-Day Vulnerability ELA627081725

Source: Ashes Cybersecurity Research

Date Accessed: 2025-08-16

Incident : Zero-Day Vulnerability ELA627081725

Source: HackerOne Disclosure Attempt

Date Accessed: 2025-06-11

Incident : Zero-Day Vulnerability ELA627081725

Source: Zero Day Initiative (ZDI) Disclosure Attempt

Date Accessed: 2025-07-29

Incident : Zero-Day Vulnerability ELA627081725

Investigation Status: Ongoing (no patch released; vulnerability confirmed via Proof of Concept)

Incident : Zero-Day Vulnerability ELA627081725

Stakeholder Advisories: Customers Advised To Await Official Patch; No Temporary Mitigations Provided.

Customer Advisories: Ashes Cybersecurity (discoverer) is a paying customer; broader customer base at risk

Incident : Zero-Day Vulnerability ELA627081725

Entry Point: Exploitation Of Null Pointer Dereference In 'Elastic-Endpoint-Driver.Sys', Custom Loader To Bypass Edr,

Backdoors Established: ['Custom kernel driver for persistence']

High Value Targets: Elastic Edr/Agent Endpoints, Systems With Privileged Kernel Access,

Data Sold on Dark Web: Elastic Edr/Agent Endpoints, Systems With Privileged Kernel Access,

Incident : Zero-Day Vulnerability ELA627081725

Root Causes: Lack Of Proper Pointer Validation In Kernel-Mode Code (Cwe-476), Inadequate Input Sanitization For User-Mode Controllable Pointers In Privileged Routines, Delayed Vendor Response To Disclosure Attempts (Hackerone/Zdi), Over-Reliance On Code Signing Without Runtime Integrity Checks,

Corrective Actions: Patch Null Pointer Dereference In 'Elastic-Endpoint-Driver.Sys', Implement Stricter Kernel Driver Validation And Sandboxing, Enhance Secure Coding Practices For Privileged Components, Improve Vulnerability Disclosure And Patch Management Processes,